fix: add a Content-Security-Policy meta tag to docusaurus.config.js headTags

[kubestellar-hive]

Security Fix

Adds a Content-Security-Policy meta tag to the existing headTags array in docusaurus.config.js.

Cluster claimed by this PR: docusaurus.config.js -> headTags only. No other file is touched. No other open PR modifies docusaurus.config.js (#275 adds tests/site-config.test.mjs and only asserts that an application/ld+json tag exists, which this change preserves).

The published site shipped no policy of any kind. GitHub Pages — the deploy target in .github/workflows/deploy-gh-pages.yml — cannot set response headers, so headTags is the only place this site can express one. That matters because docs/architectures/*.md and static/img/architectures/** are regenerated from github.com/cncf/architecture, and several data/*.json files supply href and src values rendered directly by src/components/.

What it sets

base-uri 'self'; object-src 'none'; form-action 'self'

These three directives require no script-src allowance, so they cannot constrain Docusaurus hydration, the theme-switch inline script, the application/ld+json block, or docusaurus-plugin-search-local.

What it deliberately does not set

• script-src — Docusaurus emits inline bootstrap scripts, so any script-src this site could actually ship would need 'unsafe-inline'. That would provide no XSS protection while creating the false impression that it does.
• frame-ancestors — browsers ignore it when delivered via a meta tag. Clickjacking needs a real response header and a different hosting arrangement; it is out of scope here and issue [sec-check] Published site ships no Content-Security-Policy: an injected base tag would repoint every relative URL (docusaurus.config.js headTags) #356 says so explicitly.

Verification

Ran a full npm run build:production on this branch:

• The tag renders on all 46 generated pages (46/46).
• The emitted value is exactly base-uri 'self'; object-src 'none'; form-action 'self'.
• The pre-existing manifest link and application/ld+json head tags are unchanged.
• The build output contains zero base, object, embed and form elements, so no directive in this policy can break existing markup.
• npx prettier --check docusaurus.config.js passes.

Closes #356

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "sec-check". If this is an outreach PR, a human must review it and remove the label.