[Minor][Fix] Replace automatic App Bridge CSP with opt-in helper method

[lizkenyon]

Why?

PR #1997 automatically added the App Bridge script source (https://cdn.shopify.com/shopifycloud/app-bridge.js) to CSP headers for all
apps. This would cause breaking changes:

• Forcing script-src 'self' breaks inline scripts, including Vite HMR in development

What this PR does

This PR reverts the automatic approach and provides an opt-in helper method instead:

  # config/initializers/content_security_policy.rb
  config.content_security_policy do |policy|
    policy.script_src :self, :unsafe_inline
    ShopifyApp.add_csp_directives(policy)  # Adds App Bridge URL
  end

Benefits:

• ✅ No breaking changes - apps without CSP continue working
• ✅ Future-proof - can extend to add more CSP directives

Alternatives Considered

1. Constant (ShopifyApp::APPBRIDGE_SCRIPT_SRC) - Simple but less convenient, requires manual URL management
2. Controller concern - Automatic but harder to debug and still faces controller-level CSP replacement issues. In Rails,
   controller-level content_security_policy blocks completely replace application-level CSP configuration, making it impossible to read or
   preserve the developer's application-level settings.

Reviewer's guide to testing

Things to focus on

Checklist

Before submitting the PR, please consider if any of the following are needed:

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.