Use a stricter CSP setting for the API

What does this MR do and why?

When we upgraded Rails to 6.1.5.1, Rails started adding CSP headers to non-HTML requests.

This change makes the CSP headers for our API endpoints shorter and stricter.

Related to #368909 (closed)

This is also related to gitlab-com/gl-infra/production#7516 (closed) where requests started failing because of large header sizes.

How to set up and validate locally

1. Make sure CSP is enabled (it is by default)
2. Open an API request (localhost:3000/api/v4/projects)
3. Verify the CSP header is set to the new value

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.