feat: detect missing CSP configuration and say so instead of rendering a blank map

[somethingwithproof]

Is your feature request related to a problem? Please describe.

The most common failure in this repo is a blank Maps tab with nothing in the Cacti UI to explain it. #12, #15 and #16 are all the same cause: Cacti's default policy is script-src 'self' 'unsafe-inline', gpsmap_page_head() loads its JavaScript from maps.googleapis.com, and the browser refuses it. The only evidence is in the browser console, so users spend days on it (#16 ran from 2023 with no resolution, #9 has 14 comments of the same confusion).

Core has had the settings to fix this since 1.2.15. The plugin has never checked whether they are set.

Describe the solution you'd like

On the Maps page, before rendering, compare the hosts the plugin needs against content_security_alternate_sources, and check content_security_policy_script for unsafe-eval. When either is missing, render the existing "please configure Maps first" style message with the exact settings to change instead of an empty map.

Roughly:

$alternates = (string) read_config_option('content_security_alternate_sources');
$missing    = array_filter(
    array('https://maps.googleapis.com', 'https://maps.gstatic.com'),
    fn($host) => !str_contains($alternates, $host)
);

gpsmap.php already has the branch to render a message (case 'setup':), so this reuses it.

Describe alternatives you've considered

Documentation alone, which is #94. That helps someone who reads the README before installing; it does nothing for the person already staring at a blank page. Both are worth having.

Setting the values automatically on install was considered and rejected: widening a security policy without the administrator's consent is not the plugin's call.

Additional context

Wildcards are allowed in that setting (https://*.googleapis.com), so the check needs to tolerate them rather than test for an exact string.

Closing #12, #15 and #16 depends on this plus #94.

[somethingwithproof]

Note on sequencing: #8 partly obsoletes this. A self-hosted Leaflet build needs no third-party script host, so the policy problem largely disappears.

That is not a reason to defer it. People hit the blank page today, the Google provider stays supported for existing installs, and #94 only documents the manual fix rather than detecting it.