Move default-src CSP rule to ClassProvider

It was impossible to override the default-src CSP rule inside a plugin. This commit
fixes this limitation by moving the assignation of the rule from Response class to
ClassProvider.

app/ServiceProvider/ClassProvider.php

@@ -168,6 +168,7 @@ class ClassProvider implements ServiceProviderInterface
         };
 
         $container['cspRules'] = array(
+            'default-src' => "'self'",
             'style-src' => "'self' 'unsafe-inline'",
             'img-src' => '* data:',
         );