fix: Add omise cdn in CSP

[kushthedude]

Fixes #3839

[iamareebjamal]

CSP needs to change a lot. There are other violations as well. Besides, CSP statically lists heroku and local apps as allowed. This should not be the case, it should extract origin from API_BASE_URL and use that to dynamically generate CSP like in case of SENTRY_DSN

[kushthedude]

CSP needs to change a lot. There are other violations as well. Besides, CSP statically lists heroku and local apps as allowed. This should not be the case, it should extract origin from API_BASE_URL and use that to dynamically generate CSP like in case of SENTRY_DSN

@iamareebjamal What about this https://github.com/rwjblue/ember-cli-content-security-policy

[iamareebjamal]

Aren't we already using a dependency? How does this help?