pub const POLICY: &str = "script-src 'self'; worker-src 'self'; manifest-src 'self'; default-src 'self'; connect-src 'self'; img-src 'self' data: blob:; \
object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'";Expand description
Kernel spec §7.2’s policy. No page has an inline script, so it names no
hash: the web UI’s theme bootstrap is a file of its own (/theme.js).
Everything else comes from this origin: scripts, styles, fonts, API
calls and form targets (plan 4b).