Added a Content-Security-Policy to Loris

[driusan]

This adds a Content-Security-Policy header to LORIS requests loaded through main.php in order to help prevent XSS attacks.

The policy it implements is:

1. By default, only allow things that are self-hosted
2. Allow inline CSS and JS (inline JS is required for the Loris base class to load smarty variables). We should eventually try and find a way to tighten up this policy.
3. Allow unsafe-eval because jQuery requires it to load our menus. It will be fixed in jQuery 3.0.0.
   See: _evalUrl isn't Content-Security-Policy (CSP) compatible jquery/jquery#2012). After we upgrade jQuery, we should remove this.
4. Allow data URLs for fonts, because our bootstrap theme seems to load a font that way. We should probably update our theme to use a real URL and remove this.

[codecov-io]

Current coverage is 10.93%

Merging #1481 into 16.04-dev will not affect coverage as of abe5d52

@@            16.04-dev   #1481   diff @@
=========================================
  Files             103     103       
  Stmts           18026   18030     +4
  Branches            0       0       
  Methods          1020    1020       
=========================================
  Hit              1971    1971       
  Partial             0       0       
- Missed          16055   16059     +4

Review entire Coverage Diff as of abe5d52

Powered by Codecov. Updated on successful CI builds.