/oidc/callback: set CSP

[alxndrsn]

Generate the proper content-hash for the page's inline <style> element.

Together with getodk/central#1478, this closes getodk/central#1235.

What has been done to verify that this works as intended?

A whole new test.

Why is this the best possible solution? Were any other approaches considered?

Alternatives:

1. hardcode this hash into the central nginx config
2. make a more relaxed CSP for this route

1 would be easy to break if this code changes; 2 is probably not sensible for this route if the aim is improving security.

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

No visible effect, low risk.

Does this change require updates to the API documentation? If so, please update docs/api.yaml as part of this PR.

No.

Before submitting this PR, please make sure you have:

• run make test and confirmed all checks still pass OR confirm CircleCI build passes
• verified that any code from external sources are properly credited in comments or that everything is internally sourced

[matthew-white]

I ended up feeling like I had enough context to review this particular CSP PR. I remember when we added the HTML page and <style> element to lib/resources/oidc.js.

The code makes sense to me. 👍 The CSP looks locked down, with exceptions for favicon.ico and for the <style> element. The test also demonstrates that there is no console error.