CSP guide updates (mdn#36157)

* First commit of new CSP guide

* Add example

* Added clickjacking and upgrade-insecure-requests

* Further clarifications on upgrade-insecure

* Add sections on testing

* Add See also

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Talk more about XSS

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Warningify unsafe-inline

* Boldify make unguessable nonces

* Explain what directives in the first example are doing

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Give example use case for hostname policy

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Add CSP header name, use http styling

* Use scripts instead oif images

* Talk about when meta tag CSP delivery is a good option

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* Update files/en-us/web/http/csp/index.md

Co-authored-by: Hamish Willee <[email protected]>

* More review comments

* Reorder fetch source expression types

* Clarify that one nonce value is set on all style/script tags

* Clarify 'intend to include'

* Review comment

* Add javascripot: URLs

* Elaborate a little on using hashes for static pages

* Add linebreak

* Correct heading level

* Acknowledge that removing eval() can be hard: Link to trusted types

* Note that report-only policy can't be delivered in a meta element

---------

Co-authored-by: Hamish Willee <[email protected]>