Harden read-view message rendering

[dobby-coder]

A draft security advisory has been filed for the read-side message rendering path. Details (reproduction, impact, root cause, suggested fix) are in the private advisory — not repeated here to avoid public disclosure:

https://github.com/encryption4all/postguard-outlook-addon/security/advisories/GHSA-vgcm-5rmw-f4cj

Scope of the hardening work (see advisory for specifics):

• Add a restrictive Content-Security-Policy to the wrapped document rendered in the read-view iframe, so embedded resources can't be fetched regardless of markup.
• Tighten how the message sender is presented so the authoritative identity is the verified one.

Repo maintainers/collaborators can view the advisory thread for full context.

[dobby-coder]

/dobby fix — Harden the read-view rendering path per the linked private advisory. Two concrete changes: (1) In src/lib/render-body.ts add a restrictive Content-Security-Policy <meta http-equiv> into HEAD_TAGS (e.g. default-src 'none'; img-src data: blob:; style-src 'unsafe-inline'; font-src data:;, tuned to what the UI needs) so decrypted HTML bodies cannot fetch remote resources (tracking pixels / read-receipts / IP disclosure); optionally also add a CSP header in nginx/default.conf. (2) In src/taskpane/read-view.ts present the cryptographically verified sender as authoritative and stop showing the unverified MIME From as if trusted (mark unverified or reconcile + warn on mismatch). Do NOT put advisory/GHSA details or vuln specifics in the branch name, PR title, commit messages, or PR body — keep them generic (draft advisory is embargoed). Open a DRAFT PR, add a regression test for the CSP injection, run the full test suite, and assign @rubenhensen as reviewer.