fix: tighten whiteboard collaboration CSP

[hweihwang]

Summary

• Apply Whiteboard CSP only on page routes that can host Whiteboard, including Talk and /call pages.
• Add the configured collaboration backend HTTP(S) origin and matching WS(S) origin to connect-src without wildcards.
• Self-host Excalidraw fonts and fail the build if the CDN fallback rewrite stops matching.

Fixed issues

Fixes #1250
Fixes #1222
Fixes #1215
Fixes #1198

[gseilheimer]

Heads-up from testing this area on 1.5.9 (Nextcloud 34.0.1): tightening connect-src without adding libraries.excalidraw.com will keep #724 broken.

The "Add to Excalidraw" flow imports via a plain browser fetch() of the .excalidrawlib from libraries.excalidraw.com, so it needs that origin in connect-src. Today it is never added — getCollabBackendCspConnectDomains() derives origins strictly from collabBackendUrl — and this PR keeps that shape, so the library import stays blocked.

Details and evidence in #724 (comment).

[hweihwang]

Thanks for catching this, good call @gseilheimer. We’ve pushed the fix to allow libraries.excalidraw.com in connect-src when external libraries are enabled, along with test coverage