chore: add and configure seckit

Refs: OPS-10398

composer.json

@@ -176,6 +176,7 @@
         "drupal/rdf": "^2.0",
         "drupal/redirect": "^1.6",
         "drupal/search_api": "^1.28",
+        "drupal/seckit": "^2.0",
         "drupal/semanticviews": "^3.0",
         "drupal/social_auth": "^3.0",
         "drupal/social_auth_hid": "^3.2",

config/core.extension.yml

@@ -28,7 +28,6 @@ module:
   content_moderation: 0
   contextual: 0
   core_event_dispatcher: 0
-  csp: 0
   ctools: 0
   datetime: 0
   ds_switch_view_mode: 0
@@ -100,6 +99,7 @@ module:
   search: 0
   search_api: 0
   search_api_db: 0
+  seckit: 0
   semanticviews: 0
   serialization: 0
   shortcut: 0

config/seckit.settings.yml

@@ -0,0 +1,56 @@
+_core:
+  default_config_hash: x6bhN6WZwfVUI_LLMvRJIUW_2c26VTaBozbfXmJWmro
+seckit_xss:
+  csp:
+    checkbox: true
+    vendor-prefix:
+      x: true
+      webkit: false
+    report-only: false
+    default-src: "'self'"
+    script-src: "'self' 'unsafe-inline' fonts.googleapis.com www.gstatic.com https://*.google.com https://*.googletagmanager.com *.google-analytics.com *.github.io"
+    object-src: "'none'"
+    style-src: "'self' 'unsafe-inline' fonts.googleapis.com *.github.io"
+    img-src: "'self' data: https://*.google-analytics.com https://*.googletagmanager.com gstatic.com *.github.com"
+    media-src: "'none'"
+    frame-src: "'self'"
+    frame-ancestors: "'self'"
+    child-src: "'self'"
+    font-src: "'self' data: fonts.gstatic.com"
+    connect-src: "'self' https://*.google-analytics.com https://analytics.google.com https://*.analytics.google.com https://*.googletagmanager.com *.unocha.org *.github.io"
+    report-uri: /report-csp-violation
+    upgrade-req: false
+    policy-uri: ''
+  x_xss:
+    seckit_x_xss_option_disable: Disabled
+    seckit_x_xss_option_0: '0'
+    seckit_x_xss_option_1: 1;
+    seckit_x_xss_option_1_block: '1; mode=block'
+    select: 0
+seckit_csrf:
+  origin: true
+  origin_whitelist: ''
+seckit_clickjacking:
+  js_css_noscript: false
+  noscript_message: 'Sorry, you need to enable JavaScript to visit this website.'
+  x_frame: '1'
+  x_frame_allow_from: ''
+seckit_ssl:
+  hsts: true
+  hsts_subdomains: true
+  hsts_max_age: 31536000
+  hsts_preload: false
+seckit_ct:
+  expect_ct: false
+  max_age: 86400
+  report_uri: ''
+  enforce: false
+seckit_fp:
+  feature_policy: false
+  feature_policy_policy: ''
+seckit_various:
+  from_origin: false
+  from_origin_destination: same
+  referrer_policy: false
+  referrer_policy_policy: strict-origin-when-cross-origin
+  disable_autocomplete: false