[Backport 3.5] [Security] update csp configuration

[opensearch-trigger-bot]

Backport f2f3098 from #11536.

[github-actions]

❌ Invalid Changelog Heading

The '## Changelog' heading in your PR description is either missing or malformed. Please make sure that your PR description includes a '## Changelog' heading with proper spelling, capitalization, spacing, and Markdown syntax.

[codecov]

Codecov Report

❌ Patch coverage is 91.22807% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.15%. Comparing base (ae191d3) to head (3982995).

Files with missing lines	Patch %	Lines
...re/server/http_resources/http_resources_service.ts	33.33%	1 Missing and 1 partial ⚠️
src/core/server/csp/csp_config.ts	96.66%	0 Missing and 1 partial ⚠️
...e/server/csp_report_only/csp_report_only_config.ts	66.66%	0 Missing and 1 partial ⚠️
src/legacy/ui/ui_render/ui_render_mixin.js	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              3.5   #11541      +/-   ##
==========================================
+ Coverage   60.13%   60.15%   +0.02%     
==========================================
  Files        4651     4651              
  Lines      129341   129389      +48     
  Branches    21986    21995       +9     
==========================================
+ Hits        77777    77833      +56     
+ Misses      46031    46020      -11     
- Partials     5533     5536       +3     

Flag	Coverage Δ
Linux_1	24.81% <44.64%> (+0.01%)	⬆️
Linux_2	38.34% <91.22%> (+0.05%)	⬆️
Linux_3	40.01% <44.64%> (+<0.01%)	⬆️
Linux_4	33.52% <61.40%> (+0.01%)	⬆️
Windows_1	24.84% <44.64%> (+0.02%)	⬆️
Windows_2	38.31% <91.22%> (+0.05%)	⬆️
Windows_3	40.02% <44.64%> (+<0.01%)	⬆️
Windows_4	33.52% <61.40%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.