Restore Cloudflare CSP rules needed for WAF/Turnstile

Cloudflare WAF requires cloudflareinsights.com and challenges.cloudflare.com
in script-src, connect-src, frame-src and external_redirects.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/packages/nelmio_security.yaml

@@ -26,9 +26,12 @@ nelmio_security:
                 - 'https://stripe.com'
                 - 'https://*.stripe.com'
                 - 'https://js.stripe.com'
+                - 'https://cloudflare.com'
+                - 'https://*.cloudflareinsights.com'
                 - 'https://challenges.cloudflare.com'
             script-src:
                 - 'self'
+                - 'https://static.cloudflareinsights.com'
                 - 'https://challenges.cloudflare.com'
                 - 'https://cdn.jsdelivr.net'
                 - 'https://js.stripe.com'
@@ -50,6 +53,8 @@ nelmio_security:
                 - 'blob:'
             connect-src:
                 - 'self'
+                - 'https://cloudflareinsights.com'
+                - 'https://static.cloudflareinsights.com'
                 - 'https://challenges.cloudflare.com'
                 - 'https://nominatim.openstreetmap.org'
                 - 'https://cdn.jsdelivr.net'
@@ -81,6 +86,8 @@ nelmio_security:
         forward_as: redirUrl
         log: true
         allow_list:
+            - cloudflareinsights.com
+            - static.cloudflareinsights.com
             - stripe.com
             - connect.stripe.com
             - checkout.stripe.com

config/packages/prod/nelmio_security.yaml

@@ -4,6 +4,8 @@ nelmio_security:
             script-src:
                 - 'self'
                 - 'nonce'
+                - 'https://static.cloudflareinsights.com'
+                - 'https://challenges.cloudflare.com'
 
             # Restreindre les soumissions de formulaires à notre domaine
             # et aux redirections OAuth des plateformes de partage social