Fix CC license CSP error

[janbrasna]

One-line summary

CC serves their assets via mirror* subdomain, violating the CSP rule here. Keeping the policy loosened for just this one occurrence doesn't seem to be worth it so this PR stores the SVG badge for CC-BY-SA locally.

Significant changes and points to review

Also removes creativecommons.org from img-src CSP.

Issue / Bugzilla link

Fixes #14889

Testing

http://localhost:8000/en-US/foundation/licensing/website-content/
(+to see the additional report-only header locally, you have to provide some reporting endpoint in ENV for CSP_REPORT_URI)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.34%. Comparing base (d6c3871) to head (61dd061).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #14895   +/-   ##
=======================================
  Coverage   77.34%   77.34%           
=======================================
  Files         161      161           
  Lines        8348     8348           
=======================================
  Hits         6457     6457           
  Misses       1891     1891           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[alexgibson]

Thanks for helping out with this! Just a couple of things below:

[alexgibson]

Can we please load this as a regular <img>? I don't think we really gain much here by in-lining the image, and having inline images makes them hard to search for in the future.

[janbrasna]

I originally used a more modern iconography, that was just a few shapes:

But they seem not to use the "some rights reserved" tagline much these days anymore, so I opted for one of the buttons instead eventually.

Looking at this button code, it's rather large, yea. I'll move it out.

[alexgibson]

I think we are pretty safe just to remove creativecommons.org from _csp_img_src entirely, as a quick search suggests this is the only image we load from that domain.

[alexgibson]

r+ thanks!

I'm going to hold off merging this as we're now in a code freeze for our upcoming company moz-week event. But we'll merge this after Aug 19th.

[janbrasna]

Ack. Did my best to hotfix it beforehand;) to silence the logs/reports, but given this page is outside of any IA structure it hopefully won't get much pings during the few weeks.

[alexgibson]

but given this page is outside of any IA structure it hopefully won't get much pings during the few weeks.

Yeah this page gets very little (to virtually no) traffic. It's likely content that we will remove/migrate somewhere else in the mid-term future as part of the site refresh.

[alexgibson]

Going to merge this (we discussed thing like this are OK to merge, but we won't deploy them)