fix(#502): extend CSP to work with monaco-editor

docker/includes/security-headers-online.conf

@@ -3,4 +3,4 @@ include /etc/nginx/includes/security-headers-base.conf;
 # Govern what content can be loaded by the server and from where
 # Click jacking prevention to be used in addition to X-Frame-Options
 # Requires allowing inline-styles and inline data objects (svg imgs)
-add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'; ";
+add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:  https://cdn.jsdelivr.net/npm/[email protected]/min/; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'; script-src-elem 'self' https://cdn.jsdelivr.net/npm/[email protected]/min/; style-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/[email protected]/min/;";