This issue tracks the addition of the Content-Security-Policy header to Jenkins core, so that https://plugins.jenkins.io/csp/ no longer needs to be installed.

The core implementation also needs to be extensible, so that plugins can add, e.g., img-src values.