Merge pull request #18732 from overleaf/jpa-server-pro-csp

[server-ce] enable CSP by default in Server CE/Pro

GitOrigin-RevId: 8c7664a39f688a748f33e3158b594b9368457661

server-ce/config/settings.js

@@ -208,6 +208,10 @@ const settings = {
       process.env.OVERLEAF_SESSION_SECRET || process.env.CRYPTO_RANDOM,
   },
 
+  csp: {
+    enabled: process.env.OVERLEAF_CSP_ENABLED !== 'false',
+  },
+
   // These credentials are used for authenticating api requests
   // between services that may need to go over public channels
   httpAuthUsers,