Firefox 108 issues with IDP 4.x w/ strict CSP

[Cantor, Scott]

Trying to support CSP would mean trying to exbed all the Javascript (inline won't really work), and there are no portable/tractable ways to do that. The code turns into a giant mess of different event handling in different browsers. So that's why there are no Javascript-related CSP headers configured into it by default.

Obviously the templates are fully overrideable (even the eventual SAML binding template, remember that also includes Javascript), so if somebody wants to go nuts, it's not prevented.

-- Scott