fix: remove legacy CSP eval allowance

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

lib/Controller/PageController.php

@@ -120,7 +120,6 @@ public function index(): TemplateResponse {
 		$response = new TemplateResponse(Application::APP_ID, 'main');
 
 		$policy = new ContentSecurityPolicy();
-		$policy->allowEvalScript(true);
 		$policy->addAllowedFrameDomain('\'self\'');
 		$policy->addAllowedWorkerSrcDomain("'self'");
 		$response->setContentSecurityPolicy($policy);
@@ -387,7 +386,6 @@ public function sign(string $uuid): TemplateResponse {
 		$response = new TemplateResponse(Application::APP_ID, 'external', [], TemplateResponse::RENDER_AS_BASE);
 
 		$policy = new ContentSecurityPolicy();
-		$policy->allowEvalScript(true);
 		$policy->addAllowedWorkerSrcDomain("'self'");
 		$response->setContentSecurityPolicy($policy);
 

lib/Middleware/InjectionMiddleware.php

@@ -326,7 +326,6 @@ public function afterException($controller, $methodName, \Exception $exception):
 			);
 
 			$policy = new ContentSecurityPolicy();
-			$policy->allowEvalScript(true);
 			$policy->addAllowedFrameDomain('\'self\'');
 			$response->setContentSecurityPolicy($policy);
 			return $response;