Tighten CSP rules

[kjlubick]

Description

As a defense-in-depth practice, we want to limit CSP to the minimum viable set. This PR removes seemingly extraneous scopes and should not affect any UX.

Release intent

Changelog title

n/a

Changelog body

n/a

Bumps

• services: none
• nvpair-cluster-manager: none
• nvpair-engine-manager: none
• nvpair-errors: none
• nvpair-job-scheduler: none
• nvpair-manual-nodes: none
• nvpair-node-info: none
• nvpair-node-scanner: none
• nvpair-node-settings: none
• nvpair-proxy: none
• nvpair-tui: none
• nvpair-ui-broker: none
• nvpair-workload-manager: none

Scope

This only protects the UI, not any server side code.

Validation

New test added and run locally.

Risk

This only affects the UI, so I don't believe any services need to have a version bump

Checklist

• I have read the Contributing Guidelines.
• Every commit is signed off (git commit -s), certifying the Developer Certificate of Origin.
• New or existing tests cover the change.
• Relevant documentation is updated.
• I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
• I recorded the validation commands and results above.
• I declared version bumps in the release-intent block above. services/versions.json is written by automation — do not edit it by hand.