Update CSP Policy to Address Specific Violations

[neumerance]

Summary

This PR updates the Content Security Policy (CSP) configuration to address specific violations logged in the csp_violations.log file. The changes focus on resolving issues related to blocked Facebook images and browser extension font files.

Changes Made

img-src Directive

• Added http://graph.facebook.com to allow Facebook profile images served over HTTP.
• This resolves violations where Facebook images were blocked (e.g., http://graph.facebook.com/10154757275959288/picture).

font-src Directive

• Added chrome-extension: to allow font files loaded by browser extensions.
• This resolves violations caused by blocked font files from extensions (e.g., chrome-extension://jcmcbmdmfmelmlelagelpfhmohipjjia/Inter-Medium.woff2).

Testing

• Verified that the updated CSP policy resolves the reported violations in a development environment.
• Ensured no new CSP violations are introduced by these changes.

Next Steps

• Monitor the csp_violations.log file post-deployment to confirm the effectiveness of these updates.
• Continue refining the CSP policy as new violations are identified.