CSP testing

[spike-rabbit]

Angular recommends a default CSP header: https://angular.dev/best-practices/security#content-security-policy.
We should target to comply with that.

For that we also need automated testing. A possible way is, to set a CSP header when running the e2e tests.
That way we would achieve a relative high coverage.

Steps:

1. refactor live-preview to only rely on unsafe-eval if an example is edited (refactor(live-preview): render examples through runtime shell #2576)
2. enable the CSP header with report-only to find all affected examples
3. fix all locations / eventually adjust the CSP header config needed