Move CSP-Headers to middleware

[fraxachun]

Description

Until this PR we defined the Content-Security-Policy header in next.config.js, which is then created during build. The problem is that (at least in our pipelines) environment variables (like process.env.ADMIN_URL) are not available during the build resulting in empty header values.

This has not turned out as a problem until now, because when using the site embedded in an I-Frame it was protected by the OAuth2-Proxy which strips this header. But since vivid-planet/comet#2554 this will produce an error.

The solution is to send this header in the middleware where we have access to the environment variables. However, this (probably) comes with a speed penalty since the code is executed for every request.

[nsams]

Not ideal, I would like to have the middleware as small as possible. But there seems to be no other way to do this.

Maybe, you could extract that to an function (and file)?

[johnnyomair]

What about the block preview, which isn't handled by the middleware? Shouldn't we add the headers for it as well? And redirects/rewrites (although I believe we don't need them there)

[fraxachun]

Maybe, you could extract that to an function (and file)?

e7406b1

What about the block preview, which isn't handled by the middleware?

With this commit the block-preview also sends the headers. However, I'm not sure if the block-preview needs to send them, /block-preview could be excluded by the matcher in the first place. However, we still need the frame-ancestor directive for the site preview, so moving to the middleware still is necessary.

[nsams]

I will come up with a proposal for more elegantly combining multiple middlewares (in a future PR)

[nsams]

I will come up with a proposal for more elegantly combining multiple middlewares (in a future PR)

vivid-planet/comet#2728