feat(repo): add stricter headers to network requests Refs BFE-449

[BrownBrownBear]

So I've added headers in three different places.

• In the nextjs middleware which is recommended for nextjs apps. However, I found that calls we were using in berajs weren't respecting these headers being applied. They're also a bit loose where for the content security policy so I'll just breakdown each one here:

default-src 'self' https: http:    // Allows loading resources from same origin and any HTTPS/HTTP source
script-src 'self'                  // Allows JavaScript from:
         'unsafe-inline'           // - Inline scripts (needed for dynamic)
         'unsafe-eval'             // - eval() and similar functions
         https://*.vercel-scripts.com  // - Vercel scripts
         https://*.hotjar.com      // - Hotjar analytics
style-src 'self' 'unsafe-inline'   // Allows CSS from same origin and inline styles
img-src 'self' data: https: http:  // Allows images from same origin, data URIs, and any HTTP/HTTPS source
connect-src 'self' https: http: ws: wss:  // Allows connections (fetch, WebSocket, etc.)

• In the graphql clients. These ones are a bit more strict and apply the recommended headers by halborn.
• In the wagmi config. This will target all http calls to the rpc endpoint.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
storybook	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 13, 2025 1:42am
v2-honey	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 13, 2025 1:42am
v2-hub	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 13, 2025 1:42am

6 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
bartio-dex	⬜️ Ignored (Inspect)	Visit Preview		Jan 13, 2025 1:42am
bartio-honey	⬜️ Ignored (Inspect)	Visit Preview		Jan 13, 2025 1:42am
bartio-lend	⬜️ Ignored (Inspect)	Visit Preview		Jan 13, 2025 1:42am
bartio-perps	⬜️ Ignored (Inspect)	Visit Preview		Jan 13, 2025 1:42am
bartio-station	⬜️ Ignored (Inspect)	Visit Preview		Jan 13, 2025 1:42am
berajs-docs	⬜️ Ignored (Inspect)			Jan 13, 2025 1:42am

[BrownBrownBear]

Nextjs injected scripts with nonce: https://nextjs.org/docs/pages/building-your-application/configuring/content-security-policy
vercel/next.js#54152

Next-Themes script: pacocoursey/next-themes#36

Decided to keep inline-styles just because then we would need stylesheets or tailwind exclusive for all styles we use

[BrownBrownBear]

@bearpong they recommended adding specific connections so i've done that here.

[bearpong]

LGMT, let's slightly refactor some parts:

• read env variables to whitelist script-src and other csp headers
• create a shared file for any repeated code (image patterns and middlewares)