Integrate NelmioSecurityBundle bundle, or similar, for setting a CSP
https://github.com/nelmio/NelmioSecurityBundle
Bundles could tell the core bundle which things are allowed, so it could merge that information and pass it to the security bundle. For backwards compat we could allow bundles to enforce it, and only then check if the security bundle is installed and enabled.
For example setting a CSP.
We'll likely need to collect all and set them in one go, and have some good defaults for the API docs.
(I remember that we can't just combine them, since the stricter one wins, so they need to be combined per source type)