Content-Security-Policy in DataPower Merged

This RFE was created at the request of IBM, in support case TS017042758.

To mitigate appscan scanning vulnerabilities.

The current value is as follows: Content-Security-Policy: default-src 'unsafe-eval' 'unsafe-inline' 'self'; frame-ancestors 'self'

It is requested to add safe values ​​as mentioned in the scan:

Missing or Insecure "Object-Src" or "Default-src" policy in "Content-Security-Policy" header:

	Configure your server to send the "Content-Security-Policy" header with proper values for "object-src" and "default-src" directiveIt is recommended to configure object-src directive with secure values such as 'self' or 'none' and if needed, 
	you should use 'unsafe-inline' or'unsafe-eval' with nonce or hash-algorithm
	
Missing or Insecure "Script-Src" or "Default-src" policy in "Content-Security-Policy" header
	
	Configure your server to send the "Content-Security-Policy" header with proper values for "script-src" and "default-src" directiveIt is recommended to configure script-src directive with secure values such as 'none', 
	'strict-dynamic' or if needed, you should use 'unsafe-inline'or 'unsafe-eval' with nonce or hash-algorithm, NOT with 'self' to 'script-src' or 'default-src'.
		
Missing or Insecure "Style-Src" or "Default-src" policy in "Content-Security-Policy"
	
	Configure your server to send the "Content-Security-Policy" header with proper values for "style-src".
	It is recommended to configure style-src directive with secure values such as 'self' or 'none' and if needed, you should use 'unsafe-inline' or'unsafe-eval' with nonce or hash-algorithm.
	If style-src directive is not set explicitly, consider having default-src which acts as a fallback and insecure values should also be avoided for"default-src" directive. Safe "default-src" values include 'none', and 'unsafe-inline', 'unsafe-eval' together with nonce or hash algorithm.