Remove unsafe-inline from CSP and fix syntax errors

[Copilot]

Description

Removes 'unsafe-inline' from the style-src Content Security Policy directive in the Caddy configuration, eliminating an XSS attack vector. Also corrects invalid double semicolons in the CSP syntax.

Fixes #(issue number for unsafe-inline CSP security risk)

Changes:

• Removed 'unsafe-inline' from style-src directive in frontend/Caddyfile
• Fixed double semicolons after default-src and script-src directives to single semicolons

The application uses only external stylesheets (Vite-bundled CSS, Bootstrap, Google Fonts, FontAwesome). No inline styles exist in source or build output.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• Documentation update

How Has This Been Tested?

• New unit tests
• New integrated tests
• New component tests
• New end-to-end tests
• New user flow tests
• No new tests are required
• Manual tests (description below)
• Updated existing tests

Verified existing unit tests pass and frontend builds successfully.

Checklist

• I have read the CONTRIBUTING doc
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have already been accepted and merged

Further comments

CSP 'unsafe-inline' allows arbitrary inline styles, which can be injected by attackers. Modern frontend tooling (Vite, React) compiles all styles to external CSS files, making this directive unnecessary and a security liability.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Look into unsafe inline csp in caddy as it is a security risk</issue_title>
<issue_description></issue_description>

<agent_instructions>https://github.com/bcgov/copilot-instructions/blob/main/.github/copilot-upstream.md</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Look into unsafe inline csp in caddy as it is a security risk #1902

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.