Fix CSP for external fetches

[yelodevopsi]

Check https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src if relevant for Graphik Font

[yelodevopsi]

Sources:

• https://dev.to/snaka/securing-your-nextjs-application-with-strict-csp-4lie
• https://nextjs.org/docs/pages/building-your-application/routing/custom-document
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
• https://content-security-policy.com/

[yelodevopsi]

https://stackoverflow.com/a/71789784

[yelodevopsi]

Found bug here with Next.js:
vercel/next.js#55129

Solved by upgrading to:

    "eslint-config-next": "13.4.20-canary.41",
    "next": "13.4.20-canary.40",

Why not 13.5.2?
Because of warnings:
vercel/next.js#55663

[yelodevopsi]

How to possible solve unsafe-evaland unsafe-inline

https://blog.devgenius.io/managing-unsafe-eval-and-unsafe-inline-of-content-security-policy-csp-for-frontend-spa-99752762aa53

[yelodevopsi]

Likely because we don't run server-side from the page.tsx, we're unable to get nonce on localhost (index.html) load.
Splitting this up into a new Issue, and setting PR to current commit state.