App unable to render in Spin due to missing CSP

[AxelTheGerman]

Issue summary

Shopify Admin refuses to render my app because of a missing frame-ancestor CSP (similar to #1321) - is there any way to customize the CSP setting?

• shopify_api version: not sure
• shopify_app version: 21.4.1 as well as 21.6.0
• Ruby version: 3.2.2
• Operating system: x86_64-linux

// Paste any relevant logs here

Expected behavior

The app should render as it does here when hard coding the host name for the frame-ancestor CSP:

Actual behavior

The app doesn't render due to misconfigured CSP:

and

[AxelTheGerman]

Solved this by adding into the controller that serves the embedded app:

  content_security_policy do |policy|
    policy.frame_ancestors "development.host" if Rails.env.development?
  end