nginx/csp: backend "pages" should be 100% locked down

[alxndrsn]

For any paths which are not expected to be loaded as the main browser document, any CSP header served should lock down 100%.

Confirm if there are paths which are expected to be loaded as the main browser document (e.g. #1478, potentially other OIDC paths).

I think this is OK:

• /oidc/callback has special handling
• /oidc/login should always send a redirect rather than rendering content

[matthew-white]

Closed by #1524.