content security policy for checkout page

EtherHiding skimmers hide payloads in smart contracts, so blocklists fail. See the CSP, SRI and hosted-field settings that stop them at checkout.