chore: Enable experimental CSP support

[cleptric]

Enable Astro's experimental Content Security Policy support for the site.

The is:inline directive on the theme toggle script is removed so Astro
can hash it and include it in the CSP header. Inline scripts bypass
Astro's CSP pipeline and would be blocked by the policy.

See https://docs.astro.build/en/reference/experimental-flags/csp/

<meta http-equiv="content-security-policy" content="script-src 'self' 'sha256-N1rr5W+ifZ0kn31Hxuo/d4/f6/5OUySJqjco32RMIRc=' 'sha256-BF0290pkb3jxQsE7z00xR8Imp8X34FLC88L0lkMnrGw=' 'sha256-QzWFZi+FLIx23tnm9SBU4aEgx4x8DsuASP07mfqol/c=' 'sha256-0chmwFk0zaA528yFfGV7J9ppIpdfTPPULncDF3WG7Zs=' 'sha256-eIXWvAmxkr251LJZkjniEK5LcPF3NkapbJepohwYRIc=' 'sha256-Q2BPg90ZMplYY+FSdApNErhpWafg2hcRRbndmvxuL/Q='; style-src 'self' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=';">

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sentry-engineering	Ready	Preview, Comment	Feb 20, 2026 0:25am

[geoffg-sentry]

I'm not the best here, but I think we some scripts might get blocked when we throw on CSP. I think we gotta allow google fonts, probably some twitter resources too like

  csp: {
    styleDirective: {
      resources: ["https://fonts.googleapis.com","https://platform.twitter.com"]
    }

There's a script in BaseLayout.astro that is:inline so that's likely going to be blocked, but I don't think we can just remove it. Searching quickly and I think we add the hash ourselves with https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertscripthash

And I saw <script define:vars={{ listId }}> in PostList.astro but I'm not sure how to fix this one.