Widens the browser Content-Security-Policy for the captcha widget, and only while the captcha is enabled.
The widget loads a script from Cloudflare and then draws itself in an iframe
served from the same host, so script-src and frame-src both have to name
that origin — under the policy in GamendWeb.Router.Shared the widget is
otherwise blocked outright.
This is a plug rather than an extra term in the policy because
plug :put_secure_browser_headers, RouterShared.browser_headers() evaluates
its options when the router compiles. A settings lookup there would run
before runtime.exs has read the environment, baking in whatever the compiled
default happened to be. Deciding per request is what makes
GAMEND_CAPTCHA_ENABLED mean anything, and it keeps deployments that never
enable the captcha on exactly the policy they have today.