Fix frame-ancestors blocking the disco pane loading

[muffinresearch]

STR:

• Go to about:config , change the extensions.webserver.discoverURL host to point at discovery.addons.allizom.org
• Hit about:addons and click get addons.

What happens:

• "Blocked by Content Security Policy" page

What should happen:

• The about:addons page should render normally.

[muffinresearch]

Testing with Charles replacing the frame-ancestors 'none' value with about:addons works as expected. Wasn't the case see update below.

[muffinresearch]

It seems this isn't going to work after all. I made a mistake with the charles testing, which made it look like this worked when in fact I was modifying the header to report-only mode instead.

To fix this we need to remove the frame-ancestors directive for the disco pane or just set it to * which is probably the easiest solution unless there's another way for identifying about:addons to the CSP internals.

[muffinresearch]

Looking at the location object the protocol is about: but hostname is '' which is probably why the full string doesn't match. Replacing the directive in charles seems to have this work, so I'm going to limit to about: and see if that works when deployed.

[muffinresearch]

Confirmed this is now working: