[Jonas Elfering (keulinho)]

1. Why is this change necessary?

Static asset responses need a Content Security Policy even when served from the reverse-proxy cache. Protecting only particular extensions can leave other active documents in the asset directories without the intended policy.

2. What does this change do, exactly?

Set Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none' in vcl_deliver for every response under /media/ and /thumbnail/ in both the 6.7 and 6.8 configurations, without extension or MIME-type filtering. The policy replaces any origin CSP on these responses and applies to cache hits, misses and errors. Responses outside these paths retain their existing policy and caching behavior.

Theme and bundle responses retain their origin policy, including bundled HTML applications. Document the media and thumbnail scope in the README.

3. Describe each step to reproduce the issue or behaviour.

1. Run either image with an origin serving files under /media/ and /thumbnail/.
2. Request HTML, SVG, JavaScript, an image and an extensionless file. Every asset response must carry the policy, including cached responses and missing-file errors.
3. Request /admin, /application/rendered.html, /media-other/test.html, a theme asset and a bundled HTML application. Their origin CSP must remain unchanged.

Verified both complete VCL configurations with temporary varnishtest checks: 12 HTTP requests per version, with an asserted cache hit, query strings, error responses, media-policy replacement and origin-policy preservation for theme, bundle and application responses. These local checks use a fixture origin rather than a full Shopware installation; no test harness is included in this PR. Whitespace checks pass.

4. Please link to the relevant issues (if any).

• fix(media): align Apache static-asset CSP across recipes recipes#270
• fix(media): apply CSP to static HTML and SVG assets shopware#21659
• fix(webserver): align static HTML and SVG CSP docker#245

5. Checklist

• I have tested both image versions locally
• I have documented the media and thumbnail policy
• I have checked whitespace
• Complete repository CI before merging