:lock: implement a basic CSP so that we can pass the WAVA scan

[shankari]

The CSP has multiple limitations:

• uses unsafe-inline - I tried the nonce and it didn't work
• puts everything into default-src

Filed issue to have the template fixed https://github.com/NREL/nrel-app-template-bootstrap4/issues/16