This trips an issue when trying to authenticate through to
third-party sites, e.g. bridge.joinmastodon.org:

    Refused to send form data to 'https://bridge.joinmastodon.org/'
    because it violates the following Content Security Policy
    directive: "form-action 'self'".

Thread: https://vulpine.club/@digifox/101230933751352042

Regression from #8957

* Set CSP rules in RoR's configuration

* Override CSP setting in the embed controller to allow frames

Fixes manifest.json not being loaded because of CSP violation

h/t https://vulpine.club/@binary/100662852252438648

Also drop dev-static.glitch.social reference.