strict csp based on data website

layouts/partials/head/csp.html

+{{- with site.Data.website.external_domains -}}
 <meta
   http-equiv="Content-Security-Policy"
-  content="default-src 'self' https://* {{ if not hugo.IsProduction }}'unsafe-inline'{{ end }}" />
\ No newline at end of file
+  content="default-src 'self' {{ delimit . " " }} {{ if not hugo.IsProduction }}'unsafe-inline'{{ end }}" />
+{{- end -}}
\ No newline at end of file