Enable CSP strict mode by default

[epixa]

CSP strict mode blocks access to Kibana for any legacy browser that doesn't support rudimentary content security policy protections. This ensures that a Kibana install is not put at risk by unintentionally supporting outdated and insecure browsers.

Prior to 8.0, csp.strict is disabled by default. From 8.0 onward, csp.strict should be enabled by default to provide the maximum amount of protection for most installs. Admins that wish to support outdated and insecure browsers (e.g. IE11) can explicitly disable CSP strict mode with csp.strict: false in kibana.yml.

We should check this value in our telemetry as well so we have a better understanding of how common it is for people to disable strict mode to support things like IE11.

[elasticmachine]

Pinging @elastic/kibana-security