Configure Content Security Policy (CSP) properly

[maltesander]

From superset version 3.0.0 the TALISMAN_ENABLED defaults to true. This leads to not being able to login from external sources. The PR #415 is setting TALISMAN_ENABLED to false to keep existing functionality.
This should however be configured properly via TALISMAN_CONFIG to increase security.

See: apache/superset#24262
See: https://superset.apache.org/docs/security/#content-security-policy-csp

Issue checklist

• Describe the use-case, as far is possible. For instance, using the pattern "As a XXXX, I would like XXXX to be able to do XXXX" helps to identify the feature as well as the problem it is intended to address.
• Indicate an approximate level of importance and urgency.
• Indicate if there is a known work-around until such time as the issue has been implemented.