[BUGFIX] Support Visual Editor with restrictive CSP

[Kanti]

This keeps the editor usable even if the site policies explicitly restrict these directives or define separate style element and attribute policies.

We now tested this with the most restrictive csp.yaml that I could cum up with:
config/site/*/csp.yaml:

behavior:
  useNonce: true
  useHash: false

# Inherits default site-unspecific frontend policy mutations (enabled per default)
# @see https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/ContentSecurityPolicy/Index.html
inheritDefault: true
mutations:
  - mode: "set"
    directive: "base-uri"
    sources:
      - "'none'"
  - mode: "set"
    directive: "default-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "img-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "media-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "font-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "style-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "style-src-elem"
    sources:
      - "'none'"

  - mode: "set"
    directive: "object-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "script-src"
    sources:
      - "'none'"
  - mode: "set"
    directive: "script-src-elem"
    sources:
      - "'none'"

  - mode: "set"
    directive: "worker-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "manifest-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "connect-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "frame-src"
    sources:
      - "'none'"

  - mode: "set"
    directive: "frame-ancestors"
    sources:
      - "'none'"

  - mode: "set"
    directive: "form-action"
    sources:
      - "'none'"
  - mode: "set"
    directive: "plugin-types"
    sources:
      - "'none'"
  - mode: "set"
    directive: "require-trusted-types-for"
    sources:
      - "'script'"

  - mode: "set"
    directive: "sandbox"
    sources:
      - "'none'"
  - mode: "set"
    directive: "script-src-attr"
    sources:
      - "'none'"
  - mode: "set"
    directive: "style-src-attr"
    sources:
      - "'none'"
  - mode: "set"
    directive: "trusted-types"
    sources:
      - "'none'"

Add added all necessary mutations to the \TYPO3\CMS\VisualEditor\EventListener\PolicyMutatedEventListener

[Kanti]

@p2media could you verify that this works in your setup?

[p2media]

@Kanti No, this dosen't work without adjustments to my site package:

behavior:
  useNonce: true
  useHash: false

My setup depends on hash usage, your CSP on nonce. I'm sure, when I changed everything back to nonce usage, your CSP should work. Hash usage is not the default, I know Changelog, but it will become default once a time.

Related to pull-117, you may decide to leave it at that. I could work with my middleware so fare and maybe some day there is another solutions. Your got more open tasks, I think. ;)