docs: Add a CSP meta tag to make the tutorial compiant with the security checklist

[TomasHubelbauer]

I've asked #19775 because I was frustrated with how hard it was to find a way to fix (instead of hide) the CSP warning in Electron and I complained that even the official quick start guide wasn't compliant with the security checklist at https://electronjs.org/docs/tutorial/security. Someone helped me out with a CSP meta tag which I have later noticed is indeed mentioned in the checklist, too: https://electronjs.org/docs/tutorial/security#csp-meta-tag. I have not used the checklist one verbatim because it prevents a script tag from working when serving index.html through the file: protocol as the quick start does. I instead used the one the person in my issue recommended which seems to work well to me. I am not that well versed in CSP so there might be a better policy to include with the quick start, but this is what I've got for now.

notes: no-notes

[welcome]

💖 Thanks for opening this pull request! 💖

We use semantic commit messages to streamline the release process. Before your pull request can be merged, you should update your pull request title to start with a semantic prefix.

Examples of commit messages with semantic prefixes:

• fix: don't overwrite prevent_default if default wasn't prevented
• feat: add app.isPackaged() method
• docs: app.isDefaultProtocolClient is now available on Linux

Things that will help get your PR across the finish line:

• Follow the JavaScript, C++, and Python coding style.
• Run npm run lint locally to catch formatting errors earlier.
• Document any user-facing changes you've made following the documentation styleguide.
• Include tests when adding/changing behavior.
• Include screenshots and animated GIFs whenever possible.

We get a lot of pull requests on this repo, so please be patient and we will get back to you as soon as we can.

[zcbenz]

Personally I think this is very helping, would love more comments before merging.

[welcome]

Congrats on merging your first pull request! 🎉🎉🎉

[release-clerk]

No Release Notes

[betosimo]

this do not help me, I tried EVERY possible combination and still receiving this error: because it violates the following Content Security Policy directive: "default-src capacitor-electron://* 'unsafe-inline' data:". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback