fix(webserver): align static HTML and SVG CSP

[Jonas Elfering (keulinho)]

1. Why is this change necessary?

Static assets are served directly by the webserver and do not receive application response policies. HTML and SVG should use a consistent policy, scoped so that application-rendered pages and bundled HTML applications keep their existing behavior.

2. What does this change do, exactly?

Apply script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none' to stored SVG files and existing HTML under media/ and thumbnail/ in Nginx, Caddy and FrankenPHP. Existing-file matchers keep the policy off application-rendered HTML and bundled HTML apps. Let Nginx's SVG-specific location handle SVG instead of the preceding generic extension location, retaining caching and PHP fallback. Development images inherit their corresponding server configuration; FPM-only and telemetry layers do not introduce an independent static-file handler. Document the behavior in the README.

Images and styles remain permitted. Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions.

Correct the dev-image workflow's webserver path interpolation so Caddy/Nginx changes trigger the corresponding development-image builds. Previously those builds were skipped, leaving the structure-test job to pull a nonexistent PR image.

3. Describe each step to reproduce the issue or behaviour.

1. Serve an existing HTML file under media/ or thumbnail/, and an SVG file.
2. Check the response for the full CSP above.
3. Open a bundled HTML application or an application-rendered page; its response policy should retain its existing behavior.

Validation: Built the PHP 8.4 Nginx, Caddy and FrankenPHP Dockerfiles locally on ARM64 and ran their normal entrypoints with a fixture PHP application. Native configuration validation and 70 HTTP cases pass, including content types, asset/application policy scope, HEAD, byte ranges and missing-file handling. Nginx/Caddy use the published unchanged FPM base via the named build context. No local registry publication or full Shopware installation was performed.

For the CI correction, a temporary local check reproduces the skipped Caddy/Nginx builds with the old filter and confirms both match the PR's changed files with the corrected interpolation. Actionlint syntax/expression validation passes with the existing custom runner-label and unrelated ShellCheck findings excluded. The full GitHub build/test rerun is pending.

4. Please link to the relevant issues (if any).

• fix(media): apply CSP to static HTML and SVG assets shopware#21659
• fix(installer): align static HTML and SVG CSP web-installer#33
• fix(media): align Apache static-asset CSP across recipes recipes#270
• docs(security): document stored asset CSP and CDN requirements docs#2613
• fix(shopware): align Caddy static-asset CSP helm-charts#330

5. Checklist

• I have tested the changed configuration
• I have checked that rendered HTML and bundled HTML applications retain their behavior
• I have checked whitespace and syntax where applicable
• Complete repository CI before merging