Introduce image & CSS CSP controls

### Description

As an extra step to harden security.
Compared to JS/iframes, this'll probably be relatively permissive by default to prevent breaking changes, since there's a lower risk for these elements, but we can then have options and guidance on how to tighten rules where desired. 