[TTAHUB-3040] Resolve OWASP warnings

[thewatermethod]

Description of change

Resolve OWASP generated warnings in the CI around the content security policy by adding new configuration and self-hosting a font we previously linked from Google. Also disallowed the "x-powered-by" header to stop easy sniffing of our platform code.

Note that we are currently unable to resolve one medium issue around the style-src CSP. Plotly still injects CSS in an manner considered unsafe. issue, fix awaiting merge

How to test

Confirm that all the "medium" errors are resolved in the dynamic security scan. except for the 1 that cannot be resolved ("style-src contains unsafe-inline"

Confirm that assets are still loaded as expected and the site still functions, etc. This PR is deployed to sandbox for easier testing.

Issue(s)

• https://jira.acf.gov/browse/TTAHUB-3039
• https://jira.acf.gov/browse/TTAHUB-3040

Checklists

Every PR

• Meets issue criteria
• JIRA ticket status updated
• Code is meaningfully tested
• Meets accessibility standards (WCAG 2.1 Levels A, AA)
• API Documentation updated
• Boundary diagram updated
• Logical Data Model updated
• Architectural Decision Records written for major infrastructure decisions
• UI review complete

Before merge to main

• OHS demo complete
• Ready to create production PR

Production Deploy

• Staging smoke test completed

After merge/deploy

• Update JIRA ticket status