Fix attachment Content-Security-Policy

[wxiaoguang]

See the comments. Others are not changed, only added a new rule for medias: serveHeaderCspMedia

[Copilot]

Pull request overview

This PR updates how attachment-serving responses set Content-Security-Policy based on the served Content-Type, and adds tests to verify the new CSP selection behavior.

Changes:

• Refactors header-setting logic into a helper that sets Content-Type-related headers and a CSP policy.
• Introduces CSP variants for default, PDF, and audio/video content types.
• Adds a unit test to validate CSP selection for several content types.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
modules/httplib/serve.go	Introduces CSP constants and factors Content-Type/CSP header setting into a helper used by ServeSetHeaders.
modules/httplib/serve_test.go	Adds a table-driven test for CSP selection and imports typesniffer for SVG MIME coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[silverwind]

Two minor nits, neither blocking:

1. The new comment // "style-src" is for SVG inline styles (maybe) — the (maybe) understates it. style-src 'unsafe-inline' is a known requirement for SVG inline <style> rendering in this project, not speculation. Worth firming up the wording.

2. TestServeSetHeaderContentRelated only asserts the CSP header. Since serveSetHeaderContentRelated also sets Content-Type (with the application/octet-stream default when empty) and X-Content-Type-Options: nosniff, it'd be good to assert those too — they're part of the helper's contract.

---

Reviewed by Claude Opus 4.7.