add CSP

[dreamfall]

📝 A short description of the changes

• add CSP allowing ckeditor and clarity

🔗 Link to the relevant story (or stories)

• https://app.asana.com/0/1200504523179343/1200504402630968

Deployment implications

• this might break external resources from being loaded, so need to be tested with caution

✅ Checklist

• Features that cannot go live are behind a feature flag/env var or specify deploy date and open PR as draft
• I have checked that commit messages make sense and explain the reasoning for each change
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have squashed any unnecessary or part-finished commits

🖼️ Screenshots (if appropriate - no PII/Prod data):

[matthewford]

We should add a violation endpoint so we can monitor them - think we can do this with appsignal not sure