[CORE-27] Add CSP Header

[kevinmarete]

Jira: https://broadworkbench.atlassian.net/browse/CORE-27

Description:

This PR adds a Content Security Policy (CSP) header to the Thurloe Swagger page and endpoints to enhance security by reducing the risk of cross-site scripting (XSS) and data injection attacks.

Testing:

• Added tests for csp header and ran them successfully
• Compiled project and observed no issues

---

• Submitter: Make sure Swagger is updated if API changes
• Submitter: If updating admin endpoints, also update firecloud-admin-cli
• Submitter: Update FISMA documentation if changes to:
  • Authentication
  • Authorization
  • Encryption
  • Audit trails
• Submitter: If you're adding new libraries, sign us up to security updates for them

[kevinmarete]

Tests were failing due to this missing reference.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.27%. Comparing base (f27d5fe) to head (ac12dcb).
Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #334      +/-   ##
===========================================
+ Coverage    55.92%   59.27%   +3.35%     
===========================================
  Files           17       18       +1     
  Lines          633      636       +3     
  Branches        69       68       -1     
===========================================
+ Hits           354      377      +23     
+ Misses         279      259      -20     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[kevinmarete]

Codecov Report

Attention: Patch coverage is 57.69231% with 11 lines in your changes missing coverage. Please review.

Project coverage is 59.34%. Comparing base (f27d5fe) to head (8cec42e).

Files with missing lines Patch % Lines
...in/scala/thurloe/service/ThurloeServiceActor.scala 56.52% 10 Missing ⚠️
src/main/scala/thurloe/Main.scala 0.00% 1 Missing ⚠️
Additional details and impacted files
☔ View full report in Codecov by Sentry. 📢 Have feedback on the report? Share it here.

Note: Some of these changes were formatting related to scalafmt!

[dvoet]

This code calls addCSP in 3 places, once in Main which covers all routes, then 2 other redundant times in ThurloeServiceActor. I think it need only be called once but it makes more sense to have that be in ThurloeServiceActor where route is defined:

  def route: Route = addCSP {
    swaggerUiService ~ statusRoute ~ fireCloudProtectedRoutes
  }

Alternately, we could do this in the apache proxy.