Fix kapa.ai widget blocked by the ASF default CSP

[tuhaihe]

The kapa.ai "Ask AI" widget never shows up on cloudberry.apache.org. ASF infra serves every *.apache.org site with a default Content-Security-Policy whose script-src only allows *.apache.org and a few other hosts, so the browser refuses to load
https://widget.kapa.ai/kapa-widget.bundle.js. The local dev server sends no CSP, which is why it worked there.

Add static/.htaccess to override the policy, the same way the Apache Doris website does. It keeps the ASF default sources except the Scarf host, which this site does not use, and adds what the widget needs:

• script-src: widget.kapa.ai and hCaptcha
• connect-src: proxy.kapa.ai, metrics.kapa.ai, Kapa's Cloud Run proxy and hCaptcha
• style-src and frame-src: hCaptcha

Docusaurus copies static/.htaccess into build/, so it is published to asf-site with the rest of the site.

See: Issue#401 #401

Assisted-by: Claude Code

closes: #ISSUE_Number

---

Change logs

Describe your change clearly, including what problem is being solved or what document is being added or updated.

Contributor's checklist

Here are some reminders before you submit your pull request:

• Make sure that your Pull Request has a clear title and commit message. You can take the Git commit template as a reference.
• Learn the code contribution and doc contribution guides for better collaboration.
• Make sure that your changes deployment preview is successful.
• List your communications in the GitHub Issues or Discussions (if has or needed).
• Feel free to ask for the cloudberry committers or other people to help review and approve.