Add object_src Content-Security-Policy directive

[Fryguy]

@jrafanie Please review.

While we have set default_src to 'self', some scanners want to see each field explicitly called out anyway, so this PR adds in the missing object_src directive.

see apache changes:

• Update apache header content-security-policy manageiq-appliance#383
• update content-security-policy to match apache manageiq-pods#1093

[miq-bot]

Checked commits Fryguy/manageiq@04ceead~...f5a6995 with ruby 2.7.8, rubocop 1.56.3, haml-lint 0.51.0, and yamllint
1 file checked, 0 offenses detected
Everything looks fine. 🍪

[kbrock]

of note around headers:

  gem "secure_headers",                 "~>3.9"

the current version is 6.5

[kbrock]

I've verified that the only change to the response (used http://localhost:3000/ ) was the addition of a header:

Content-Security-Policy::
object-src 'self'; 

Final result:

Content-Security-Policy: default-src 'self'; child-src 'self';
connect-src 'self' fonts.gstatic.com ws://localhost:3000;
font-src 'self' fonts.gstatic.com fonts.googleapis.com;
img-src 'self' data:; object-src 'self';
script-src 'unsafe-eval' 'unsafe-inline' 'self';
style-src 'unsafe-inline' 'self'