v0.9.9

Deploy order: stellar-api 0.9.9 first, then its image backfill, then this.
This release closes the CSP's img-src, font-src and connect-src (#402).
It depends on stellar-api 0.9.9's *Src fields (#403), and any remote image
the backfill has not imported renders as its link or the surface's default.
Run the backfill (node dist/scripts/backfill-remote-images.js in the api
container) and deploy this only on a clean report.

The image also serves the bundle from /etc/nginx/snippets/stellar-ui.conf
(#400), which stellar-compose's proxy includes from this release on.

Changed

• The production CSP closes the resource axes (#402,
  stellar-api#457):
  img-src 'self' data:, font-src 'self', and connect-src 'self' plus
  the Sentry ingest origin. No page loads an image, font or connection from
  another host.
  • The Sentry origin comes from SENTRY_DSN at build time. A build with a
    DSN that is not an https URL now fails.
  • data: images stay, because the form controls draw their chevrons and
    ticks as data: SVGs, which make no request.
  • A member's external stylesheet can no longer load a remote image or
    font. style-src stays open for the sheet itself (ADR-0024), but
    img-src and font-src hold for whatever it references.
  • Deploy only after the stellar-api release carrying #742 and #745, and
    after its image backfill (#738) has reported clean.
  • The policy moves to webpack.csp.js. ADR-0003 is amended.
  • A new e2e test, P-14, fails on any CSP violation on a community, a
    release, a profile, a forum thread with an [img] and a form. The dev
    server emits no CSP, so it only bites against a production build, which is
    what stellar-compose's e2e runs.
• The image serves the bundle from a snippet (#400,
  ADR-0011). The serving config
  moves to /etc/nginx/snippets/stellar-ui.conf: root, gzip, etag and the
  SPA fallback. default.conf now only wraps it in a server block, so the
  image run on its own behaves as before.
  • stellar-compose will include the same file in its proxy, instead of
    carrying its own copy, which dropped gzip
    (stellar-compose#58).
  • image/png is no longer gzipped, since PNGs are already compressed.
  • The build job now checks the running image: CSS arrives as text/css,
    JS arrives gzipped, and a deep link falls back to the index.
• Every image is drawn from its resolved *Src field (#403,
  stellar-api ADR-0051).
  Avatars, release and group covers, collage mosaics, donor icons and the
  homepage features now render from avatarSrc, imageSrc, customIconSrc,
  secondAvatarSrc and coverImagesSrc. Each is a same-origin path, or null
  while a remote image is not imported, so no image loads from another host.
  • A pending or failed image shows the surface's default. The seeded test
    avatar still maps to its bundled image.
  • Edit forms keep reading and saving the raw fields, so a member's URL
    round-trips unchanged.
  • Needs a stellar-api release carrying #742 and #745. This clears the way
    for the CSP to close img-src (#402).
  • A new e2e test, P-13, gives the member a remote avatar and fails on any
    image request to another origin across the main pages and the profile.