Register filters & servlets later + CSP improvements

[labkey-adam]

Rationale

Change #⁠1: We were registering filters and servlets with Tomcat very early in the startup process, before the list of modules had even been finalized. Also, one client deployment ran into this issue: https://github.com/LabKey/internal-issues/issues/1008; unclear what caused this, but deferring registration might help. This change moves filter and servlet registration much later, to just before we start Tomcat.

Change #⁠2: Previously, our CSP filter would check the base server URL to determine if the server supported https and, if so, always include the report-to directive and related header, regardless of the current request's scheme. The header would be configured with an absolute (https:) URL. This was an attempt to ensure the browser would use report-to regardless of the request's scheme. In reality, (on Chrome, at least), with report-to configured, an http: request would result in no report being sent (neither report-to nor not report-uri). While it's not critical that we support this corner case (CSP violations occurring from an http request to a server configured for https), switching to an approach that determines whether to add the report-to directive and header based solely on the current request's scheme removes unnecessary complexity from the filter. We also switch to adding a single Reporting-Endpoints header instead of one per CSP filter. https://github.com/LabKey/internal-issues/issues/956

Existing automated tests should cover both changes.

Related Pull Requests

• https://github.com/LabKey/premiumModules/pull/502