Update apache header content-security-policy

updates:
- object-src ManageIQ/manageiq#23001
- font-src img-src, style-src ManageIQ/manageiq#21822
- connect-src ManageIQ/manageiq-ui-classic#8227
- style-src, script-src: ManageIQ/manageiq#4647

COPY/etc/httpd/conf.d/manageiq-https-application.conf

@@ -24,7 +24,7 @@ SSLCertificateKeyFile /var/www/miq/vmdb/certs/server.cer.key
 
 <Location /assets/>
   Header unset ETag
-  Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self'; font-src 'self' fonts.gstatic.com; script-src 'self'; style-src 'self'; report-uri /dashboard/csp_report"
+  Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self' fonts.gstatic.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; img-src 'self' data:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self' fonts.googleapis.com fonts.gstatic.com; report-uri /dashboard/csp_report"
   Header set X-Content-Type-Options             "nosniff"
   Header set X-Frame-Options                    "SAMEORIGIN"
   Header set X-Permitted-Cross-Domain-Policies  "none"
@@ -37,7 +37,7 @@ SSLCertificateKeyFile /var/www/miq/vmdb/certs/server.cer.key
 
 <Location /packs/>
   Header unset ETag
-  Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self'; font-src 'self' fonts.gstatic.com; script-src 'self'; style-src 'self'; report-uri /dashboard/csp_report"
+  Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self' fonts.gstatic.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; img-src 'self' data:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self' fonts.googleapis.com fonts.gstatic.com; report-uri /dashboard/csp_report"
   Header set X-Content-Type-Options             "nosniff"
   Header set X-Frame-Options                    "SAMEORIGIN"
   Header set X-Permitted-Cross-Domain-Policies  "none"