Describe the bug

It seems that version 1.27.0 actively removes all CSP headers.

I updated from 1.26.3 to 1.27.0 using git. Afterwards I got the warning in FreshRSS: "The CSP header in use is unsafe and FreshRSS may be vulnerable to XSS attacks." I read the documentation and tested myself and I found outr two things:
1: There are no CSP headers sent in FreshRSS.
2: I have no CSP headers set myself. Other paths on my webserver also have no CSP headers.
3: If I enable CSP headers in my webserver config, then they are sent in all other locations but not on /FreshRSS path.

Using Apache2 2.4.58 on Ubuntu 24.04.

I also downgraded back to version 1.26.3 and the warning is gone. But when I was searching respone headers I also do not see any. Also if I enable them in server config, then they are in other paths but not in /FreshRSS, just like with 1.27.0, just without warning. So maybe the problem is something else and 1.27.0 has this new warning feature? I see some CSP changes in release information. But then I'm quite clueless where I messed up. I tend to leave as much in default as possible.

To Reproduce

1. Go to my private server URL /FreshRSS
2. Log in
3. See warning message
4. Cannot find CSP Headers in response

Expected behavior

1. Go to my private server URL /FreshRSS
2. Log in
3. See no warning message
4. Find secure CSP Headers in response

FreshRSS version

1.27.0

System information

• Database version: mariadb 10.11.13
• PHP version: 8.3
• Installation type: git
• Web server type: Apache 2.4.58
• OS: Ubuntu 24.04
• Browser: Firefox 141.0.3

Additional context

No response