Unsafe sandbox

[ianopolous]

The headers described for webtiles here allow side channel attacks and possibly sandbox escape. For prior art on how to solve this see (and please reference) the implementation in Peergos (starting here: https://peergos.org/posts/a-better-web and ending in the source code https://github.com/Peergos/Peergos/blob/master/src/peergos/server/net/StaticHandler.java#L190, or feel free to ask questions on bluesky).

A couple of high level problems in no particular order:

1. Missing Cross-Origin-Embedder-Policy: require-corp which means no cross origin isolation
2. allowing blob: and data: as script sources is dangerous
3. Same, but for default-src (POLA)
4. allow-popups-to-escape-sandbox is dangerous and can allow bypassing the CSP to make arbitrary network requests
5. form-src is not a valid CSP header I think

I recommend adding connect-src: self or none as well.