Fix CSP configuration for django-csp 4

[mathjazz]

Fix #4492.

[flodolo]

Django deal with uppercase variable names… 😵

[flodolo]

One issue pointed out by LLMs: this test would fail locally for someone with SITE=https:// (couldn't verify on the device I'm currently in).

-def test_content_security_policy(rf):
+def test_content_security_policy(rf, settings):
     response = CSPMiddleware(lambda request: HttpResponse())(rf.get("/"))

+    # These directives get an http: fallback if the site isn't hosted on HTTPS
+    http = "" if settings.SITE_URL.startswith("https") else " http:"
+
     policy = response.headers["Content-Security-Policy"]
     assert "default-src 'self'" in policy
     assert "connect-src 'self'" in policy
     assert "font-src 'self'" in policy
-    assert "frame-src https: http:" in policy
+    assert f"frame-src https:{http}" in policy
     assert "img-src 'self'" in policy
     assert "script-src 'self' 'unsafe-eval'" in policy
     assert "style-src 'self' 'unsafe-inline'" in policy
-    assert "worker-src https: blob: http:" in policy
+    assert f"worker-src https: blob:{http}" in policy

[flodolo]

CI tests are stripping it out https://github.com/mozilla/pontoon/blob/main/.github/workflows/backend.yml#L73