[AssetMapper] Adding CSP details, recommending script-src 'strict-dynamic'

[ThomasLandauer]

Page: https://symfony.com/doc/6.4/frontend/asset_mapper.html#handling-css

I think there should be a clear recommendation for people using a Content-Security-Policy. Is script-src 'strict-dynamic' really the way to go? It's not possible for AssetMapper to just omit those empty CSS entries, is it? Or change them to "/assets/app.css": ""?

(The info is taken from symfony/symfony#58416 (comment))

[Copilot]

Pull Request Overview

This PR adds important Content-Security-Policy (CSP) documentation to the AssetMapper section, specifically addressing issues that occur when using script-src 'self' with CSS imports. The change clarifies how AssetMapper handles CSS imports through empty importmap entries and provides guidance for CSP configuration.

• Explains how AssetMapper creates empty importmap entries for CSS files using data: URLs
• Documents the CSP conflict that occurs with script-src 'self' when importing CSS files
• Recommends using script-src 'strict-dynamic' as a solution to CSP issues

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] The phrase 'lower the rule' is unclear and potentially confusing. Using 'strict-dynamic' is not necessarily 'lowering' security - it's a different security model. Consider rephrasing to 'change the rule to' or 'use' instead of 'lower the rule to'.

Suggested change

	ignore the error, or lower the rule to ``script-src 'strict-dynamic'``.
	ignore the error, or change the rule to ``script-src 'strict-dynamic'``.