fix(www): fix CSP headers

- allow data: sources for img tags (Captcha)
- set default-src to 'self' so that resource prefetch works
  (prefetch-src not yet supported by any browser)

test/e2e/spec/www_spec.js

@@ -156,7 +156,7 @@ describe("www/nginx", function () {
         it("has security headers", function () {
             var response = chakram.get('https://www/');
             expect(response).to.have.header('Strict-Transport-Security', 'max-age=31536000; includeSubdomains; preload');
-            expect(response).to.have.header('Content-Security-Policy', "default-src 'none'; frame-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'self'; frame-ancestors 'none'; block-all-mixed-content; form-action 'none';");
+            expect(response).to.have.header('Content-Security-Policy', "default-src 'self'; frame-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'self'; frame-ancestors 'none'; block-all-mixed-content; form-action 'none';");
             expect(response).to.have.header('X-Frame-Options', 'deny');
             expect(response).to.have.header('X-Content-Type-Options', 'nosniff');
             expect(response).to.have.header('Referrer-Policy', 'strict-origin-when-cross-origin');

www/conf/sites-available/90-desec.static.location

@@ -3,7 +3,7 @@
 #####
 location / {
     add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
-    add_header Content-Security-Policy "default-src 'none'; frame-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'self'; frame-ancestors 'none'; block-all-mixed-content; form-action 'none';" always;
+    add_header Content-Security-Policy "default-src 'self'; frame-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'self'; frame-ancestors 'none'; block-all-mixed-content; form-action 'none';" always;
     add_header X-Frame-Options "deny" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;