Restricts script, style, img, connect, media, and frame sources to known-safe origins. Blocks object embeds and enforces base-uri self. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>