Implement CSP for the registrar console (#3129)

Implement a hybrid Content Security Policy (CSP) for the Registrar Console
to protect against XSS

- The CspFilter injects the proper headers on the Java backend endpoints
- Uinsg Jetty's HeaderFilter to inject the header for statically-served
  frontend assets

We need to add the ee10-servlets.ini file for Jetty to have acess to the
HeaderFilter class

jetty/src/main/jetty-base/start.d/ee10-servlets.ini

@@ -0,0 +1,4 @@
+# ---------------------------------------
+# Module: ee10-servlets
+# ---------------------------------------
+--module=ee10-servlets

jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml

@@ -3,6 +3,24 @@
             xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
             version="5.0">
 
+        <filter>
+            <filter-name>CspHeaderFilter</filter-name>
+            <filter-class>org.eclipse.jetty.ee10.servlets.HeaderFilter</filter-class>
+            <init-param>
+                <param-name>headerConfig</param-name>
+                <param-value>
+                    set Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self';
+                    set X-Content-Type-Options: nosniff
+                    set X-Frame-Options: DENY
+                </param-value>
+            </init-param>
+        </filter>
+
+        <filter-mapping>
+            <filter-name>CspHeaderFilter</filter-name>
+            <url-pattern>/*</url-pattern>
+        </filter-mapping>
+
         <servlet>
             <servlet-name>default-no-cache</servlet-name>
             <servlet-class>org.eclipse.jetty.ee10.servlet.DefaultServlet</servlet-class>

jetty/src/main/webapp/WEB-INF/web.xml

@@ -2,6 +2,17 @@
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
   version="6.0">
+  <!-- Filters -->
+  <filter>
+    <filter-name>CspFilter</filter-name>
+    <filter-class>google.registry.ui.server.CspFilter</filter-class>
+  </filter>
+
+  <filter-mapping>
+    <filter-name>CspFilter</filter-name>
+    <url-pattern>/*</url-pattern>
+  </filter-mapping>
+
   <!-- Servlets -->
 
   <!-- Servlet for injected frontend actions -->