fix: allow inline styles from angular-sanitize in CSP

[mantariksh]

Problem

Since the last release a week ago, Sentry has had 1.2m events due to CSP errors. While the errors do not seem to affect any functionality, they are likely to cause us to burst our Sentry limits again.

In particular, there are problems caused by the angular-sanitize package, which show up in both the form.gov.sg landing page and all public forms:

As well as problems due to the jquery package, which show up in the form.gov.sg landing page:

Solution

Allow inline styles from angular-sanitize.js by adding the relevant hash to the allowed style-src list. This fixes the issue on public forms:

However, the issue with jquery is less straightforward because it sets attributes rather than inline style tags, so we cannot use a hash. Since we don't want to introduce security vulnerabilities by adding unsafe-inline, it seems we have to put up with our Sentry being somewhat polluted by CSP errors until we move to React. Hopefully fixing the issue for angular-sanitize will significantly reduce the errors, since that is the issue which appears on public forms.

[liangyuanruo]

lgtm. Could you also configure sentry to block the event to preserve our quota? The option is under the project settings somewhere.