WD-36600: allow regional google.* domains in connect-src for GTM

[Skazitron]

Done

• Added ~40 country-specific www.google.* hostnames (EU, Americas, APAC, MEA) to connect-src in webapp/handlers.py so the GTM ads/ga-audiences pixel can fire for
  visitors in those regions.

QA

• From a few geographies (or via VPN / Chrome --lang + cookie spoofing): load the homepage with the cookie banner accepted, then check DevTools → Network for the
  ads/ga-audiences request to www.google.<tld> and confirm it is not blocked by CSP.
• Console should not show Refused to connect to 'https://www.google.<tld>/…' because it violates the following Content Security Policy directive: "connect-src …" for any
  of the listed domains.
• Diff Content-Security-Policy response header against main — only connect-src should grow; no other directive changes.

[webteam-app]

Demo

Jenkins

demos.haus

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.77%. Comparing base (750d3e1) to head (bf5aee0).
⚠️ Report is 5 commits behind head on feature/WD-36600-csp.

Files with missing lines	Patch %	Lines
webapp/handlers.py	75.00%	4 Missing ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           feature/WD-36600-csp    #2542      +/-   ##
========================================================
- Coverage                 78.80%   78.77%   -0.04%     
========================================================
  Files                        16       16              
  Lines                      1953     1969      +16     
========================================================
+ Hits                       1539     1551      +12     
- Misses                      414      418       +4     

Flag	Coverage Δ
python	78.77% <75.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Ataku-B]

How do we decide which regional Google domains to use here? Google has a supported domains list, could we use that as the source of regional Google domains?

[Skazitron]

@Ataku-B Nice! I didn't know that google provided a list like that. I suppose we can use that instead of what Gemini spat out.

[Skazitron]

@Ataku-B updated handlers.py to fetch google domains dynamically.

[Ataku-B]

👍 Approved! Thank you!