[BUGFIX] Parse csp.yaml with placeholders

Replace ENV variables in config/sites/*/csp.yaml.

Previously, a string like `https://%env(BASE_DOMAIN)%/`
was passed through without any placeholder substitution, because
the YamlFileLoader::PROCESS_PLACEHOLDERS flag was not set.

By omitting any flag, by default the loader is able to process
both imports and placeholder substitution.

This allows embedded ENV variables in the csp.yaml files to
be evaluated properly.

Resolves: #105432
Releases: main, 13.4, 12.4
Change-Id: I3e25b9db4ae42d47f20c3e897a858e2d3732d453
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86731
Reviewed-by: Benni Mack <benni@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Markus Sommer <markus@letsbenow.de>
Tested-by: Garvin Hicking <gh@faktor-e.de>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Markus Sommer <markus@letsbenow.de>

Author: sebastian-iffland

typo3/sysext/core/Classes/Configuration/SiteConfiguration.php

@@ -275,7 +275,7 @@ protected function getContentSecurityPolicies(string $siteIdentifier): array
     {
         $fileName = $this->configPath . '/' . $siteIdentifier . '/' . self::CONTENT_SECURITY_FILE_NAME;
         if (file_exists($fileName)) {
-            return $this->yamlFileLoader->load(GeneralUtility::fixWindowsFilePath($fileName), YamlFileLoader::PROCESS_IMPORTS);
+            return $this->yamlFileLoader->load(GeneralUtility::fixWindowsFilePath($fileName));
         }
         return [];
     }