More security fixes

Fix CSP inline script/style hash mismatches

- Normalize templates/index.html to LF line endings; browsers
  normalize CRLF to LF before hashing inline <script> content per
  the HTML5 spec, causing a hash mismatch against the CSP whitelist.
- Update the script-src hash in main.go to match the LF-normalized
  content.
- Whitelist the ionicons library's inline style hash in style-src
  instead of using unsafe-inline.
- Add .gitattributes to enforce LF line endings for templates/*.html
  so Windows checkouts don't reintroduce CRLF and break the hash again.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>