fix(canary): CSP allows challenges.cloudflare.com for Turnstile

Audit F10: script-src 'self' blocked the Turnstile bootstrap script
(https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget
iframe. Added challenges.cloudflare.com to script-src, connect-src, and a
new frame-src directive so the widget can render under prod CSP.

PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go

@@ -42,18 +42,19 @@ func SecurityHeaders(isProduction bool) func(http.Handler) http.Handler {
 func buildCSP(isProduction bool) string {
 	directives := []string{
 		"default-src 'self'",
-		"script-src 'self'",
+		"script-src 'self' https://challenges.cloudflare.com",
 		"style-src 'self' 'unsafe-inline'",
 		"img-src 'self' data: https:",
 		"font-src 'self'",
-		"connect-src 'self'",
+		"connect-src 'self' https://challenges.cloudflare.com",
+		"frame-src https://challenges.cloudflare.com",
 		"frame-ancestors 'none'",
 		"base-uri 'self'",
 		"form-action 'self'",
 	}
 
 	if !isProduction {
-		directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'"
+		directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com"
 	}
 
 	return strings.Join(directives, "; ")