Add comments for each directive

Author: dhogan8

bin/_headers.config.ts

@@ -17,6 +17,8 @@ const config: HeadersConfig = {
       pattern: '/*',
       headers: {
         'Content-Security-Policy': {
+          // Allow AJAX/fetch requests to status page, marketing site, HubSpot,
+          // and Google services for analytics and tag management
           'connect-src': [
             `'self'`,
             'https://status.maxmind.com',
@@ -30,18 +32,28 @@ const config: HeadersConfig = {
             'https://*.g.doubleclick.net',
             'https://*.google.com',
           ],
+          // Fallback for resources not covered by other directives
           'default-src': [`'self'`],
+          // Allow fonts from our site and Google Fonts
           'font-src': [`'self'`, 'https://fonts.gstatic.com'],
+          // Only allow form submissions to our own domain
           'form-action': [`'self'`],
+          // Prevent this site from being embedded in iframes on other domains
           'frame-ancestors': [`'self'`],
+          // Allow embedding content from HubSpot and Google services
           'frame-src': [
             `'self'`,
             'https://app.hubspot.com',
             'https://www.google.com',
             'https://www.googletagmanager.com',
           ],
+          // Allow images from our site, data URIs, and any HTTPS source
           'img-src': [`'self'`, 'data:', 'https:'],
+          // Block all plugins (Flash, Java, etc.)
           'object-src': [`'none'`],
+          // Allow scripts from our site, HubSpot, Google services, and inline scripts
+          // 'unsafe-inline' needed for HubSpot and Google Tag Manager
+          // 'report-sample' includes script sample in violation reports
           'script-src': [
             `'self'`,
             `'report-sample'`,
@@ -57,6 +69,8 @@ const config: HeadersConfig = {
             'https://www.google.com',
             'https://*.googletagmanager.com',
           ],
+          // Allow styles from our site, Google Fonts, and inline styles
+          // 'unsafe-inline' needed for dynamic styling
           'style-src': [
             `'self'`,
             `'unsafe-inline'`,