This allows setting a Content-Security-Policy HTTP header (refs #15727). Special thanks to blighj, the original author of this patch.
Thanks Aymeric Augustin and Florian Apolloner for work on the patch.