[LG-7191] Suppress content security policy

[gangelo]

Suppress content security policy if IdentityConfig.store.suppress_content_security_policy is true.

508 tools that rely on javascript execution (ANDI for example) are unable to execute in the development environment due to Content Security Policy (CSP) policies.

Creating/setting IdentityConfig.store.suppress_content_security_policy in an AWS sandbox will allow developers to turn CSP off, allowing these valuable tools to run.

[zachmargolis]

this methods opens up the policy, does it still cause problems for the accessibiltiy tool on this step if we leave it in?

[gangelo]

Not sure about that, I have to test that out.

[aduth]

Would the existing disable_csp_unsafe_inline configuration help with the need? Could we consider other tools? It's a bit concerning to me that a tool wouldn't be functional without the ability to download third-party scripts or call out to a third-party API. Historically I've been able to use the Deque Axe DevTools and Accessibility Insights for Web extensions without any issues, and those have been pretty popular in the program.

If we did add this, would the idea be to only allow for it in local development, and not in any deployed environments?