Improve content security policy in renderer and in webview iframe

[tjcouch-sil]

There are some improvements we can make to tighten security by modifying our content security policy in renderer's index.ejs and in webview's WebViewService.ts:

• Improve index.ejs connect-src ws: so it specifies the url we are supposed to connect to as listed in ClientNetworkConnector.ts
• Improve index.ejs and web-view.service.ts script-src so they don't use 'unsafe-inline'
  • It seems 'unsafe-inline' needs to be here because iframes with srcdoc sources inherits the CSP of their parent frame and layer over it with their own. We need to move web view source to be served from the backend. Then they can have their own independent CSP. But we need to make sure to serve them from the same origin or they won't be able to use papi and such.
    • Source: https://stackoverflow.com/questions/43236626/what-csp-child-iframe-inherits-from-its-parent
      https://stackoverflow.com/questions/30428681/is-it-possible-to-have-csp-only-apply-to-the-parent-frame-not-any-iframes
    • More considerations https://security.stackexchange.com/questions/254512/how-do-i-safely-host-third-party-javascript-code-in-an-iframe
    • We should also evaluate where is appropriate to allow our custom protocol (papi-extension:) - probably don't need it outside of webviews, so putting it on frame-src and nothing else might work just fine if we get the unsafe-inline problem fixed
    • When we get webviews served with an independent CSP, should we also remove wasm-unsafe-inline from parent? Could that be an avenue to inject code into the parent from children? Don't think so currently
• Determine if we should use script-src vs script-src-elem (disabling in-line attribute scripts) in index.ejs and in WebViewService.ts. Does this decision actually impact security?
  • Since we are preventing children from executing scripts on the parent by monkey-patching document.createElement and watching script and iframe tags, yes, this does impact security. We now use script-src-elem to avoid having to watch every avenue through which inline scripts could come from children.

Closely related to #227

[tjcouch-sil]

Split a couple things out into higher priority #227