Follow best practices for CSP compliance

[GeekInTheNorth]

It is best practice for both the Website UI and the CMS Backend to be covered by security headers including a CSP. Damage to a brand can be achieved by via gaining accessing the back end using phishing attacks etc and so this too should be protected.

When a Content Security Policy is used to govern the entire platform (including the CMS backend), then the CSP currently has to be opened to include the dependencies for this module. This includes multiple packages under the maxcdn.bootstrapcdn.com, code.jquery.com and cdnjs.cloudflare.com domains and depending how specific the CSP is, this can potentially open the entirety of the site to these domains.

It would be more ideal for the assets used for the Geta Optimizely Sitemaps to be accessible purely using the 'self' source. This can be achieved by packing these libraries into the \modules\_protected\Geta.Optimizely.Sitemaps folder and self serving them.