Consider applying improved CSP via unattended upgrades

[emkll]

Description

In #4678, a stronger CSP was introduced, but the Apache configuration for both Source and Journalist interfaces are applied via Ansible.

Therefore, there is a slight discrepancy between the CSP in Apache configurations between 1.1.0 and earlier versions.

As a result, instances installed from 1.0.0 or below will not have this CSP applied. Starting from 1.1.0, running the installer will apply this configuration change, but this ticket is to track providing these changes via unattended upgrades (e.g.: modifying the Apache configurations via the postinst for securedrop-app-code)

Given the risk of breakage and the likelihood of news orgs running the installer post 1.1.0 (for tor v3), I don't see a strong enough argument to provide those changes via unattended upgrades. Does anyone think otherwise?

[emkll]

Because we will be updating the base OS for all servers as part of #4768 and requiring an Ansible run, CSP changes will be applied by this Ansible run. Closing.