Fix CSP problems with Jira connect self-managed

What does this MR do and why?

This fixes the CORS problem described here: !89378 (comment 973388865)

The fix has two parts:

1. Allow a self-managed instance as connect-src
   • This is done with the changes in app/controllers/jira_connect/subscriptions_controller.rb
   • It lists the self-manage instance as a trusted source so we can request it through javascript
2. Add GitLab.com as a trusted origin for /-/jira_connect/oauth_application_id endpoint.
   • This is done with the changes in config/application.rb
   • it enables the self-managed instance to receive requests from GitLab.com

How to set up and validate locally

1. Enable the jira_connect_oauth_self_managed feature in Rails console Feature.enable(:jira_connect_oauth_self_managed)
2. Enable the jira_connect_oauth feature in Rails console Feature.enable(:jira_connect_oauth)
3. Go to http://localhost:3000/admin/application_settings/general
4. Expand GitLab for Jira App
5. Enter 1234 and click Save changes
6. Run the preflight request

   curl --head --location --request OPTIONS 'http://127.0.0.1:3000/-/jira_connect/oauth_application_id' --header 'Origin: http://notgitlab.com'

7. Verify that the response headers contain Access-Control-Allow-Origin: *
8. Run the actual request

   curl --head --location --request GET 'http://127.0.0.1:3000/-/jira_connect/oauth_application_id' --header 'Origin: http://notgitlab.com'

9. Verify that the response headers contain Access-Control-Allow-Origin: *

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.