Add guidance for Content-Security-Policy

[levinmr]

No description provided.

[raybaxter]

This guidance is insufficient for a working implementation.

Universal-Federated-Analytics injects a script tag with src "https://www.google-analytics.com/analytics.js" without including the nonce and initiates at least 2 POST requests to https://www.google-analytics.com/.

[levinmr]

This guidance is insufficient for a working implementation.

Universal-Federated-Analytics injects a script tag with src "https://www.google-analytics.com/analytics.js" without including the nonce and initiates at least 2 POST requests to https://www.google-analytics.com/.

You're right. I've updated the guidance to be more accurate.

[levinmr]

@raybaxter please review