Allow users to set thier own Content-Security-Policy header

Allow the users to set their own CSP header. As of now, XWiki users have the same CSP which restricts them, for example, from using external javascript.

We could add a filed under Administration > Look & Feel > Presentation > under or above the "HTTP META INFO" where the user can overwrite / replace the default CSP.