Adopt a Content Security Policy

[dfabulich]

In this PR, I'm attempting to add a Content Security Policy, to provide broad, general defense against XSS attacks.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

XSS security issues occur when an attacker constructs a special link to IFDB, like this:

https://ifdb.org/allreviews?id=40ru852yszsizxsv&ratings=yes&pg=all&sortby=%3C/script%3E%27%22%3E%3Cimg%20src=x%20onError=prompt(1)%3E

sortby is supposed to be a single word, like new to sort by "Newest First", but the code foolishly assumes that we can insert any text from the URL directly into the web page.

The attacker can then write their own JavaScript code that runs on our server, logged in with the current user's credentials. In this example, the attacker just runs prompt(1), as a proof of concept, but if the user is an admin, the code could just as easily delete users, promote themselves to an administrator, or do anything else than an administrator can do.

Fixing XSS issues can be a game of whack-a-mole, trying to catch every case of these, but the better fix is to add a Content Security Policy that forbids this entire kind of bug.

As I write this, there are 44 commits in this PR. 😳

I start by adding a very basic CSP header, allowing too much:

header("Content-Security-Policy: default-src 'self' ifdb.org 'nonce-$nonce' 'unsafe-eval';
style-src 'self' 'unsafe-inline';
script-src-attr 'unsafe-inline';");

This header blocks all <script> tags from working unless they have a valid nonce attribute. https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce

…so then I went through and added nonces to as many <script> tags as I could find. I think I got them all.

That then left three bugs to fix:

• unsafe-eval: Removed all calls to eval() https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
• script-src-attr 'unsafe-inline': To fix this, I had to remove all onclick attributes from the entire site, replacing them with nonce-enabled <script> tags. I did over the course of 39 other commits. 😖 (This fixed the XSS issue above.)
• style-src 'unsafe-inline': To fix this, I'll have to remove all style= attributes, of which there are 235 in the code base, and remove (or add nonces) to all <style> elements, of which there are only 9 in the code base.

… so, uh, yeah, a lot of work still to do. But I wanted to get some of this code off of my machine so people could begin reviewing it.