Add auto CSP support

Problem/Motivation

When the CSP module is enabled, automatically add the src of an iframe to the allowed sources list for CSP.

Maybe preconnect? Anything else? Other things maybe should be configured on a module level?

Maybe this should be in iframe.module instead.

Proposed resolution

Use the features provided by #3447249: Allow CSP to be added by render elements

Remaining tasks

Add CSP as a optional/recommended dep in composer.json

Tests

User interface changes

None

API changes

None

Data model changes

None