replace some hard coded clauses of the Content-Security-Policy with config

[twrichards]

@AndyKilmory noticed that there were a few things hardcoded into our CSP which we decided ought to be coming from config.

For example youtube.com (introduced in #4127) is specific to a guardian add-on (https://github.com/guardian/pinboard) which is added via the scriptsToLoad config, so this PR extends the ScriptToLoad case class to represent additionalFrameSourcesForCSP and additionalImageSourcesForCSP (to replace another hard coded pinboard thing, which makes avatars work).

In the process I've removed https://accounts.google.com from the frame-src portion (added in bcdcb2e) since I can't see how it would be used (although @andrew-nowak might have an idea).

---

• updated TEST config uploaded
• tested in TEST ✅ 🎉
• updated PROD config uploaded

[github-actions]

Deploy build 12370 to TEST

All deployment options

• Deploy build 12370 to TEST
• Deploy parts of build 12370 to TEST by previewing it first

---

From guardian/actions-riff-raff.

[andrew-nowak]

In the process I've removed https://accounts.google.com from the frame-src portion (added in bcdcb2e) since I can't see how it would be used (although @andrew-nowak might have an idea).

this is necessary at least for the guardian for panda-session to create the iframe to relog users in after their panda cookie expires, as the reauth will include a redirect through accounts.google.com in that iframe

you can test by running in your browser console document.cookie = 'panda-forceExpiry=1;domain=.test.dev-gutools.co.uk' then waiting for the next auto-refresh of the search page

[twrichards]

re-tested on TEST after some tweaks, ready for re-review 🙏

NOTE:
I've moved the https://accounts.google.com into the security.frameSources config property in kahuna.conf in response to...

In the process I've removed accounts.google.com from the frame-src portion (added in bcdcb2e) since I can't see how it would be used (although @andrew-nowak might have an idea).

this is necessary at least for the guardian for panda-session to create the iframe to relog users in after their panda cookie expires, as the reauth will include a redirect through accounts.google.com in that iframe