Enable csp report_only mode to not block inline script in the sequra …

[m1k3lm]

What is the goal?

Have the checkout working agin with the new Content Secutiry Policies at MAgento 2.4.7

In Adobe Commerce and Magento Open Source version 2.4.7 and later, CSP is configured in restrict-mode by default for payment pages in the storefront and admin areas, and in report-only mode for all other pages.

References

• Issue: jira issue goes here, if suggesting a new feature or change, please discuss it in an issue first
• Related pull-requests: list of related pull-requests (comma-separated): widget doesn't load if "dest" is empty #1, Update csp_whitelist.xml #2
• Sentry errors: list of links to Sentry errors (comma-separated): link1, link2
• Any other references (AppSignal, Prometheus, ...): list of links to other references (comma-separated): link1, link2

How is it being implemented?

We have enabled the report_only mode for our plugin

Our checkout form needs an inline script that changes and is generated outside Magento so that we can't generate a hash to add it to the csp_whitelist or use a nonce provider.

Opportunistic refactorings

Version bump

Caveats

Does it affect (changes or update) any sensitive data?

How is it tested?

Manual tests