Allow Stripe checkout in CSP form-action directive

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/packages/nelmio_security.yaml

@@ -68,6 +68,8 @@ nelmio_security:
             form-action:
                 - 'self'
                 - 'https://auth.esy-web.dev'
+                - 'https://*.stripe.com'
+                - 'https://checkout.stripe.com'
             block-all-mixed-content: true
 
     permissions_policy: