Set CSP headers to true by default

[snipe]

We had been defaulting this to false because it was causing issues with vue, but we don't use vue anymore. While we mitigate the need for a CSP elsewhere in the application code, this should make it more compliant with common security scans.

[what-the-diff]

PR Summary

• Enabling Content Security Policy
  The configuration change made in this PR enables Content Security Policy (CSP) in the application. Having CSP turned on provides an additional layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. This ensures users interact with our application in the safest possible environment.