Content security policy strict mode

[epixa]

A content security policy is a great addition to the protections built
into Kibana, but it's not effective in older browsers (like IE11) that
do not enforce the policy.

When CSP strict mode is enabled, right before the Kibana app is
bootstrapped, a basic safety check is performed to see if "naked" inline
scripts are rejected. If inline scripting is allowed by the browser,
then an error message is presented to the user and Kibana never attempts
to bootstrap.

With this change, if you set csp.strict = true in your kibana.yml and try
to load Kibana in IE11, you'll get an error message.

Follow up to #29545

[elasticmachine]

Pinging @elastic/kibana-security

[legrego]

Tested in IE11 on a windows 10 machine. I can confirm that it prevents Kibana from loading with csp.strict: true, but it's not rendering the error message, or anything for that matter.

I don't see any console errors, and I did see that it managed to set both window. __kbnCspNotEnforced__: true and window.__kbnStrictCsp: true

[epixa]

@legrego I think it's an issue with my toggle logic. Specifically I set display: flex and I bet there's some sort of override for IE that I should be applying instead. It's possible this will be addressed with the design work @snide will push. I'll hold off until he's done with that before I mess with it.

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request

[epixa]

This should be good to go.

[snide]

I tested this for functionality and did a brief code review of what I could understand. In IE with the setting enabled it displays the warning. For Chrome, it loads fine and gets passed auth with no problems.

[legrego]

LGTM - tested in chrome, both with and without CSP enabled (via https://chrome.google.com/webstore/detail/disable-content-security/ieelmcmcagommplceebfedjlakkhpden?hl=en). Also tested on IE11, works great! No issues displaying the error message either.

At one point, you had mentioned adding a console log letting folks know that a single error in the console is expected when strict mode is enabled. Is that something you still want to do?

[epixa]

@legrego I pushed some updates for your feedback. Can you give it a whirl again, particularly in IE?

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request

[legrego]

Thanks @epixa -- Tested latest round in IE and chrome; looks great!