Disable CSP by default
#31830

rafaelfranca wants to merge rafaelfranca:disable-csp-by-default into rails:master

We do not currently have an analysis of these two commits