Lack of a CSP in lisk-desktop

[eniolam1000752]

Actual behavior

Partially resolved in PR #5151. While this PR adds a CSP, the script-src directive is set to 'self' 'unsafe-inline' 'unsafe-eval'. This makes the CSP useless against XSS attacks. We recommend avoiding inline scripts if possible (and removing 'unsafe-inline' 'unsafe-eval'). If this is not possible, use a nonce- or hash-based approach. See Mozilla's Content-Security-Policy documentation for more information.