[iOS] [hackerone] Make sure original document security settings apply to Reader Mode

[stoletheminerals]

Reader mode sends pre-defined security headers. This may cause security issues if the original page has a stricter policy.
More details: #35797

[diracdeltas]

CSP

iOS sets a CSP header here that is already very restrictive: https://github.com/brave/brave-ios/blob/cc0db0c0a920868087167c2e397d77d756ec66a1/Sources/Brave/Frontend/Browser/Handlers/ReaderModeHandler.swift#L73. However we should lock it down further to this:

default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; sandbox; upgrade-insecure-requests; img-src *; style-src \(InternalURL.baseUrl) '\(ReaderModeHandler.readerModeStyleHash)'; font-src \(InternalURL.baseUrl); script-src 'nonce-\(setTitleNonce)'"]

sandbox is most likely to break something, if that is the case we can loosen it.

In addition, if we detect that the page sets img-src in CSP via either an HTTP header or a meta element, we should apply that policy instead of img-src *. Note that if you send a second CSP header or add it as a meta element, it overrides img-src * because the most restrictive policy should be applied automatically.

Subresource Integrity

for https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity, we need to make sure the HTML integrity and crossorigin attributes from the original page are preserved in the reader mode page on all elements.

Non-CSP headers

In addition to modifying the CSP, the reader mode HTTP response should set a few more security headers in https://github.com/brave/brave-ios/blob/cc0db0c0a920868087167c2e397d77d756ec66a1/Sources/Brave/Frontend/Browser/Handlers/ReaderModeHandler.swift#L69

Namely:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy:  no-referrer

[iccub]

transferred to brave-browser repo