Enforcement mode in CSP

[dannimad]

Seeing only 1 violation in CREM board after recent header changes. Talked with security team and seems we're not on the hook for that type of violations. Now turning enforcement mode back on.

[Copilot]

Pull Request Overview

This PR re-enables enforcement mode for the Content Security Policy header in the static web app configuration, replacing the previous report-only setting.

• Switched from Content-Security-Policy-Report-Only to Content-Security-Policy in headers.
• Ensures CSP violations are now blocked instead of merely reported.

Comments suppressed due to low confidence (1)

docs/static/staticwebapp.config.json:4

• [nitpick] The header key uses mixed case while cache-control is all lowercase. For consistency, consider lowercasing this JSON property name.

"Content-Security-Policy": "script-src 'self' ..."

[github-actions]

🔗 No broken links found! ✅

Your attention to detail is admirable.

linkcheck output

> fluid-framework-docs-site@0.0.0 ci:check-links /home/runner/work/FluidFramework/FluidFramework/docs
> start-server-and-test "npm run serve -- --no-open" 3000 check-links

1: starting server using command "npm run serve -- --no-open"
and when url "[ 'http://127.0.0.1:3000' ]" is responding with HTTP status code 200
running tests using command "npm run check-links"


> fluid-framework-docs-site@0.0.0 serve
> docusaurus serve --no-open

[SUCCESS] Serving "build" directory at: http://localhost:3000/

> fluid-framework-docs-site@0.0.0 check-links
> linkcheck http://localhost:3000 --skip-file skipped-urls.txt

Crawling...

Stats:
  225443 links
    1710 destination URLs
    1941 URLs ignored
       0 warnings
       0 errors