Allow the shared footer logo through CSP (#272)

Co-authored-by: Anthony Ettinger <anthony@profullstack.com>

Author: sh1pt-actions-fleet[bot]

src/server.mjs

@@ -68,7 +68,7 @@ export function createApp({
       'X-Content-Type-Options': 'nosniff',
       'Referrer-Policy': 'strict-origin-when-cross-origin',
       'Cache-Control': 'no-store',
-      'Content-Security-Policy': `default-src 'self'; script-src 'self' https://crawlproof.com ${FOOTER_SCRIPT_SRC}; style-src 'self'; img-src 'self' data: https://built.indie.pit.world https://pwamart.com; connect-src 'self' https://crawlproof.com https://pit.world; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self' https://pit.world`,
+      'Content-Security-Policy': `default-src 'self'; script-src 'self' https://crawlproof.com ${FOOTER_SCRIPT_SRC}; style-src 'self'; img-src 'self' data: https://built.indie.pit.world https://pwamart.com https://profullstack.com; connect-src 'self' https://crawlproof.com https://pit.world; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self' https://pit.world`,
       'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
     });
     const railwayHealth =

test/net-hosting.test.mjs

@@ -49,6 +49,7 @@ test('an active W3BS name page serves its shell assets and links navigation to t
     assert.match(page.body, /<h1>mint\.agent<\/h1>/);
     assert.match(page.body, /href="http:\/\/localhost:3000\/net"/);
     assert.doesNotMatch(page.body, /<a\b[^>]*href="\/(?!\/)/);
+    assert.match(page.headers['content-security-policy'], /img-src[^;]*https:\/\/profullstack\.com/);
 
     for (const [path, contentType] of [
       ['/assets/style.css', 'text/css'],