fix: webxdc: CSP bypass

[WofWca]

This doesn't appear to fix an exploitable vulnerability because host-rules is already set to disable network access, so "XDC-01-002 WP1" from the Cure53 audit has not been brought back ever since the initial fix.

Initially fixed in a9e5242
Reintroduced in fd1f8ce

Related refactor commit 2cd310e

Also bring back and improve the PDF comment about "XDC-01-005 WP1"

[nicodh]

Concerning the comment:
"This doesn't appear to fix an exploitable vulnerability because host-rules is already set to disable network access,"

We should be aware that there is an ongoing discussion wether or not we should restrict internet to predefined URLs by host rules. It blocks some useful scenarios.

So we should not rely on host rules concerning XDC-01-002 WP1

[Simon-Laux]

I disagree with removing host rules restriction, it does not protect us from this issue but also from others and even from unknown ones.
If it's about the map, just make it possible to set http headers in the core http request function and then we can use it for the map like we use it in the html email viewer.

[nicodh]

I just wanted to mention that there is a discussion. No reason to discuss it here.

[nicodh]

At least it means that this fix is useful anyway :-)