add Stripe to Teleport CSP

[michellescripts]

Essentially reverts #15891

The Cloud Team plan will leverage Stripe for billing pages/managing billing information.

supports https://github.com/gravitational/cloud/issues/3536

[jentfoo]

Does this need to be applied globally to the DefaultContentSecurityPolicy? Instead could we just append to this policy when a page specifically needs to allow stripe code?

[zmb3]

(With a few exceptions) the web UI is a single page app - the "pages" that use stripe are the same as any other part of the web UI, right?

[jentfoo]

If Stripe is being included as part of the single page app I understand this may make sense. But it sounded like this is new development, and if so, instead we should isolate the Stripe interaction on a different page. We would like to avoid providing stripe this level of trust across our entire application.

[michellescripts]

We also display an upgrade banner on all pages via Main, and the banner has a CTA with the stripe payment element.

[jentfoo]

Given the above context it sounds like it does need to be included in the default CSP. But similar to this issue we should try to see if we can improve this. We want to be mindful when introducing these integrations to make sure their scope is as limited as possible.

[klizhentas]

@michellescripts @mcbattirola since it's a golang server side file, can we do:

if plan == "team" {
   headers["script-src 'self'] = "https://js.stripe.com"
}

This change alone will massively reduce the blast radius from any OSS or Enterprise customer

[michellescripts]

cc @jimbishopp @klizhentas

[jentfoo]

Given the above context it sounds like it does need to be included in the default CSP. But similar to this issue we should try to see if we can improve this. We want to be mindful when introducing these integrations to make sure their scope is as limited as possible.