Add limited media-src CSP to report-only

[janbrasna]

One-line summary

Adds media-src CSP-RO rule to make up for RO-removed default-src wildcards.

Significant changes and points to review

Restricting defaults in #14897 may trigger some yet undefined policies, this specifically adds self+assets.m.o to media rules, to let it run in report-only for some time to see if that's the only host we need to add.

Issue / Bugzilla link

#15546

Testing

curl -I http://localhost:8000/de/

http://localhost:8000/de/firefox/built-for-you/?v=2

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.91%. Comparing base (8a8636c) to head (23a6da6).
Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #15548   +/-   ##
=======================================
  Coverage   78.90%   78.91%           
=======================================
  Files         158      158           
  Lines        8274     8275    +1     
=======================================
+ Hits         6529     6530    +1     
  Misses       1745     1745           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests
• JS Bundle Analysis - Avoid shipping oversized bundles

[robhudson]

Great!