docs(hosting): align static asset CSP on 6.4

[Jonas Elfering (keulinho)]

1. Why is this change necessary?

The published 6.4 server examples should use the same static HTML/SVG policy as the current hosting documentation.

2. What does this change do, exactly?

Backport the Apache and Nginx example changes from #2613. Existing HTML under media/ and thumbnail/, and static SVG files, receive script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'. Application-rendered HTML and bundled HTML apps retain their response policies. Preserve the older installer/recovery routing.

3. Describe each step to reproduce the issue or behaviour.

Use the updated example and request stored HTML/SVG, then rendered HTML and a bundled HTML app. Only the stored assets receive the dedicated policy.

Validation: the extracted 6.4 Nginx example passes native syntax validation and 13 real HTTP cases in an isolated Docker setup with fixture PHP responses. Markdown lint uses the current docs configuration. Existing obsolete http2_push_preload warnings on older Nginx examples are outside this change.

4. Please link to the relevant issues (if any).

• docs(security): document stored asset CSP and CDN requirements #2613
• fix(media): apply CSP to static HTML and SVG assets shopware#21659

5. Checklist

• I have validated the changed configuration
• I have retained the version-specific routes
• Complete repository CI before merging

[shopware-dev-docs-connector]

Developer Docs healthcheck

Status: Completed with failure.
Repository: shopware/docs
Commit: 072d875
Preview: No Vercel preview URL was found in the workflow logs.
Workflow run: #5647