Updated CSP header for Nginx add CSS

[exentler]

Here is an updated CSP header for Nginx reverse proxy
Added github as source for the Settings-> About -> Releases
Is it possible to get CSS files direct from the server instead of rsms.me?

# Reduce XSS risks (Content-Security-Policy) - uncomment to use and add URLs whenever necessary
add_header Content-Security-Policy "default-src 'self'; connect-src 'self' https://plex.tv https://api.github.com https://github.com; style-src 'self' 'unsafe-inline' https://rsms.me/inter/inter.css; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; img-src 'self' data: https://plex.tv https://*.githubusercontent.com https://assets.plex.tv https://gravatar.com https://secure.gravatar.com https://i2.wp.com https://image.tmdb.org; font-src 'self' https://rsms.me/inter/font-files/" always;

[TheCatLady]

The font files are also hosted on rsms.me, so there is no reason to duplicate the stylesheet within Overseerr (we also don't want to be responsible for keeping a copy of it up-to-date). See https://rsms.me/inter/ for more information.

If you don't like fetching the CSS and font files from rsms.me, you can always use sub_filter to remove/replace the reference to that stylesheet. (This is unsupported, however.)