web: CSP and referrer policy, pinned scheme, scrubbed capture env (#1025)

* web: CSP and referrer policy, pinned scheme, scrubbed capture env

* web: inline script finder matches any case and end-tag form (CodeQL)

deploy/nginx.example.conf

@@ -108,6 +108,7 @@ server {
         proxy_set_header   X-Real-IP         $remote_addr;
         proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
         proxy_set_header   X-Forwarded-Proto $scheme;
+        proxy_set_header   Forwarded         "";  # drop a client's own Forwarded: it outranks X-Forwarded-Proto
 
         # Live-update SSE (GET /api/events) holds a long-lived streaming response.
         proxy_read_timeout 3600;