Parameterize and Update CORS and CSP

[Matthew-Grayson]

🗣 Description

Update CORS and CSP
Convert CORS and CSP settings to environment variables.
Add variables to dev.env.example for local testing
Delete constants.js file

💭 Motivation and context

Updated CORS and CSP improve site security limiting which websites can request resources from our API. This reduces the risk of cross-site request forgery (CSRF) and data leakage, as only listed origins are allowed to interact with our server.
Parameterizing these settings allows us to change them using the AWS console without initiating a new deployment.
closes issue #241

🧪 Testing

All tests pass and site functions as expected. Full testing requires deployment to DMZ staging.
You must add the following new environment variables from dev.env.example to your .env file for your local environment to work.

CORS_MAIN={"origin":"http://localhost","methods":"GET,POST,PUT,DELETE,OPTIONS"}
CORS_DOCS={{"origin":"http://localhost","methods":"GET"}}
CSP_MAIN={"directives":{"defaultSrc":["'self'","http://localhost"],"frameSrc":["'self'","https://www.dhs.gov/ntas/"],"imgSrc":["'self'","http://localhost","https://www.dhs.gov"],"objectSrc":["'none'"],"scriptSrc":["'self'","http://localhost","https://www.dhs.gov"],"frameAncestors":["'none'"]}}
CSP_DOCS={"directives":{"baseUri":["'none'"],"defaultSrc":["'self'"],"frameAncestors":["'none'"],"objectSrc":["'none'"],"scriptSrc":["'none'"]}}

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced
  in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release.

[cduhn17]

Per conversation. Do we want to parameterize some of these URL's so we dont have to go through a review and release cycle in the event the URL do change.

[Matthew-Grayson]

Per @cduhn17's suggestion, I'll parameterize these settings

[rapidray12]

Needed for ANDI to run correctly