issue 1859: serve one script and one stylesheet from the page's own origin (1859.2)

ADR 0515 §6: /static/app.js and /static/app.css are built in and served with their types and nosniff; the
policy allows script and style from the origin alone and connect-src 'self'; no page carries an inline script,
a style or a handler. The script posts the page's forms without a reload and says a failure on the page.

modules/mesh-mail-web/internal/web/server.go

@@ -20,7 +20,9 @@ const OpenTool = "mail-webclient.open"
 
 // CSP is ADR 0440 §5's own policy, set on every answer: nothing loaded from elsewhere, and this page never
 // framed by another site.
-const CSP = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; " +
+// ADR 0515 §6 (issue 1859): the page's one script and one stylesheet from its own origin alone, and the script
+// talks only to it (connect-src 'self').
+const CSP = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; " +
 	"frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
 
 // InternalHost is this machine's own internal name for the module (ADR 0440 §2): the operator's own setting
@@ -54,6 +56,7 @@ func NewServer(host string, auth *Auth, b *Bundle) *Server {
 	if b != nil {
 		s.Mux.HandleFunc("/", protect(b.listPage))
 		s.Mux.HandleFunc("/all", protect(b.accountsPage))
+		s.Mux.HandleFunc("/static/", staticPage) // the script and the stylesheet carry nothing of a mail
 		s.Mux.HandleFunc("/folder", protect(b.folderPage))
 		s.Mux.HandleFunc("/search", protect(b.searchPage))
 		s.Mux.HandleFunc("/mail", protect(b.mailPage))