Manual:$wgCSPHeader

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Manual:$wgCSPReportOnlyHeader

Manual:$wgCrossSiteAJAXdomains