Update security header for Content-Security-Policy

Current Situation

• The security header value for Content-Security-Policy configured with jetty/etc/jetty-rewrite.xml includes:

  script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
  

Desired Behavior

• The security header value for Content-Security-Policy should include:

  script-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; frame-src 'self'; frame-ancestors 'self'