Make Kolibri compliant with a secure Content Security Policy

Summary

Use JSON in <template> tags rather than inline <script> tags for all our injection of data into the frontend from the backend
Add our own frontend parser (with lazy resolution when Proxies are available) for generated URL JSON data from django-js-reverse
Updates how we register i18n frontend messages, by updating our webpack configuration to inject the registration logic as the first thing to happen in the bundled JS - unless it is the core bundle, in which case it happens last, to let the core global object to be defined first
Resorbs the browser checking into the core bundle, as it increased complexity of our code, and was putting people with incompatible browsers at higher priority than our frequent users
Cleans up all our unused (non-content renderer specific) async module loading code that was relying on injected JS
Turns our in-context translation into a plugin that is not enabled by default, gets rid of the inline JS that it previously relied on and load it via a script tag
Adds the Django CSP middleware to Kolibri, and sets sensible defaults that allow Kolibri to function fully in both production and dev modes.
Adds a single CSP related deployment option to globally add host-sources to the CSP - this is done simplistically for now, and assumes that finegrained control is either not required, or can be achieved by directly changing settings if needed.

References

Fixes #12809

Note: it goes slightly beyond what is outlined in the issue, by actually adding the CSP headers as well with Django CSP, but it seemed like the only way to show it was working as intended!

Reviewer guidance

Do any assets not load properly, is anything too strictly defined for proper functioning either in production or development mode?

Is anything too loosely defined? One particular thing to note is that the iframe src is very permissive when ZIP_CONTENT_ORIGIN is not defined, because we can't set a port on self - so if we wanted to make it stricter, we'd have to dynamically set the CSP based on the host that Kolibri was accessed from.

Asset type	Download link
PEX file	kolibri-0.18.0.dev0_git.20241116002312.pex
Windows Installer (EXE)	kolibri-0.18.0.dev0+git.20241116002312-windows-setup-unsigned.exe
Debian Package	kolibri_0.18.0.dev0+git.20241116002312-0ubuntu1_all.deb
Mac Installer (DMG)	kolibri-0.18.0.dev0+git.20241116002312.dmg
Android Package (APK)	kolibri-0.18.0.dev0+git.20241116002312-0.1.4-debug.apk
TAR file	kolibri-0.18.0.dev0+git.20241116002312.tar.gz
WHL file	kolibri-0.18.0.dev0+git.20241116002312-py2.py3-none-any.whl

learningequality / kolibri