Allows adding custom static CSP directives to Coder. Niche use case but makes this easier then creating a reverse proxy that has to replace the header. We want to preserve our directives, so having an append option is preferred to a "replace" option via a reverse proxy.

Closes#15118

Some notes

We do not validate the directives set. Browsers have different sets of support, so we accept any string values.

Example configuring. The format matches the header format.

coder server ... --additional-csp-policy="script-src https://example.com google.com"# can also do it likecoder server ... --additional-csp-policy="script-src https://example.com" --additional-csp-policy="script-src https://google.com"