Ignore missing csp if page is not xss capable

[noamblitz]

Changes

We do not create missing CSP findings if the page is not XSS capable. Open for discussion:

For the other findings (misconfigured csp and disallowed domains in csp) we have two options:

1. We do not create the headers in the header normalizer for non xss capable pages using the same check (simplest option).
2. We rewrite the other bits to also gather the Content-Type header and do the same check there. It is the cleanest option but comes at the price of performance.

Issue link

#1950

Closes #1950

Demo

Please add some proof in the form of screenshots or screen recordings to show (off) new functionality, if there are interesting new features for end-users.

QA notes

Please add some information for QA on how to test the newly created code.

---

Code Checklist

• All the commits in this PR are properly PGP-signed and verified.
• This PR only contains functionality relevant to the issue.
• I have written unit tests for the changes or fixes I made.
• I have checked the documentation and made changes where necessary.
• I have performed a self-review of my code and refactored it to the best of my abilities.

• Tickets have been created for newly discovered issues.
• For any non-trivial functionality, I have added integration and/or end-to-end tests.
• I have informed others of any required .env changes files if required and changed the .env-dist accordingly.
• I have included comments in the code to elaborate on what is not self-evident from the code itself, including references to issues and discussions online, or implicit behavior of an interface.

---

Checklist for code reviewers:

Copy-paste the checklist from the docs/source/templates folder into your comment.

---

Checklist for QA:

Copy-paste the checklist from the docs/source/templates folder into your comment.

[ammar92]

Looks good! Just a few tiny remark to improve it even more

[noamblitz]

Lets decide whether we want to tackle the other csp finding in this pr or in another one, and lets also determine the best option!

[noamblitz]

We went for the second solution, need to add to release notes that a recalculate bits is needed after upgrading

[ammar92]

No remarks

[stephanie0x00]

Checklist for QA:

• I have checked out this branch, and successfully ran a fresh make reset.
• I confirmed that there are no unintended functional regressions in this branch:
  • I have managed to pass the onboarding flow
  • Objects and Findings are created properly
  • Tasks are created and completed properly
• I confirmed that the PR's advertised feature or hotfix works as intended.
• I checked the logs for errors and/or warnings and made issues where necessary

What works:

The following scenarios were tested:

• URL with svg which would trigger the No-CSP finding.
• URL with png which would not trigger the CSP finding.
• HTML URL without any CSP headers which would trigger the NO-CSP finding.

The tested scenarios all give the expected output.

What doesn't work:

n/a

Bug or feature?:

n/a

• _bull