fix(csp): upgrade UI and fix zap failure

[andaaron]

The zap scanner started to check the csp header, which is causing a warning.

We also need to ignore the rule, as both settings are read by the scanner.

Per https://w3c.github.io/webappsec-csp/#example-7bb4ce67 we can have multiple Content-Security-Policy headers, and the most restrictive policies apply. This rule doesn't seem to be applied by zap, which finds these headers, but still fails:

• URL: http://localhost:8080/
  • Method: GET
  • Parameter: content-security-policy
  • Attack: ``
  • Evidence: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src *; img-src 'self'; manifest-src 'self'; base-uri 'self'
• URL: http://localhost:8080/
  • Method: GET
  • Parameter: Content-Security-Policy
  • Attack: ``
  • Evidence: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; img-src 'self'; manifest-src 'self'; base-uri 'self'

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

Merging #1372 (1e873b9) into main (e6b81bb) will decrease coverage by 0.02%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1372      +/-   ##
==========================================
- Coverage   90.50%   90.49%   -0.02%     
==========================================
  Files          97       97              
  Lines       21503    21515      +12     
==========================================
+ Hits        19462    19469       +7     
- Misses       1526     1530       +4     
- Partials      515      516       +1     

Impacted Files	Coverage Δ
pkg/extensions/extension_ui.go	92.68% <100.00%> (+3.02%)	⬆️

... and 1 file with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more