Content-Security-Policy configuration.
Set to false to omit entirely.
undefined keeps the default (no CSP by default since it breaks apps).
ContentSecurityPolicyOptions | false
Usage
import { type SecurityHeadersOptions } from "http-security-plugin/src/index.ts";