DF-927: Tighten CSP and use nonce-aware GTM

[alexluckett]

• Updated the GTM init snippet to propagate the CSP nonce
• Hardened scriptSrc. Scripts are now trusted by nonce only, with 'strict-dynamic' for GA and interactive-map.
• Replaced wildcard GA/GTM origins with explicit hosts
• Tightened frameSrc. Only allowed when GTM is configured, else none.
• Tightened workerSrc, retaining blob: for MapLibre
• Added missing directives for baseUri, formAction, frameAncestors, objectSrc

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud