Update content security policy

- need to include google analytics domain because initialising GA involves a call to append a new script onto the DOM and run it

config/initializers/content_security_policy.rb

@@ -16,7 +16,8 @@
 
   # we're also setting a nonce, which will cause browsers which
   # support nonces to ignore the :unsafe_inline directive.
-  policy.script_src      :self, :unsafe_inline
+  policy.script_src      :self, :unsafe_inline, "https://www.google-analytics.com"
+  policy.img_src         :self, "https://www.google-analytics.com"
 
   # Specify URI for violation reports
   # policy.report_uri "/csp-violation-report-endpoint"