[RFE] Harden Apache security

[carma12]

As stated here, there are some security issues with Apache in IPA.

Highlights:

• IPA sets Content-Security-Policy in ipa.conf:
  • Header always append Content-Security-Policy "frame-ancestors 'none'"
  • none means no resources are allowed to load so it's no wonder that the page is blank.
• It just doesn't set the default-src or script-src values.
• IPA always sets X-Frame:
  • Header always append X-Frame-Options DENY

We would need to evaluate the UI to support the additional CSP values (e.g. how scripts are loaded, inline scripts, etc).

[github-actions]

This issue has not received any attention in 120 days.

[carma12]

Removed stale label as this will be eventually addressed.

[github-actions]

This issue has not received any attention in 365 days.