include app-bridge asset in the script-src csp directive

[fresh-eggs]

What this PR does

This gem requires an asset that is hosed oncdn.shopify.com:

https://cdn.shopify.com/shopifycloud/app-bridge.js

For applications that enforce a strict ContentSecurityPolicy, the asset is unlikely to be listed as a permitted script-src .

Rails offers controller APIs to add per-request exceptions to a global policy.

Applications could add exceptions to the controllers included by this gem but it would be best if the gem includes them itself. (similar pattern in maintenance_tasks gem)

Reviewer's guide to testing

This change ensures that the script-src directive on the ContentSecurityPolicy response header served by this gem's controllers include the additional value:

https://cdn.shopify.com/shopifycloud/app-bridge.js

Checklist

Before submitting the PR, please consider if any of the following are needed:

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.

[fresh-eggs]

#1997