Add CSP allowlisting for reCAPTCHA at sign in

[aduth]

🛠 Summary of changes

Adds necessary CSP exceptions to allow reCAPTCHA to be loaded when performed at sign-in.

📜 Testing Plan

You need to add configuration values for reCAPTCHA credentials, but they don't have to be valid.

In config/application.yml:

recaptcha_enterprise_api_key: 'test'
recaptcha_enterprise_project_id: 'test'
recaptcha_site_key: 'test'

Verify that the header values are present on the sign-in screen:

1. Start make run
2. In a terminal console: curl -I --silent http://localhost:3000 | grep content-security-policy
3. Observe "google.com" and "gstatic.com" domains in the resulting header value