Merge pull request #1600 from turt2live/travis/c2s/media-csp

Specify the minimum CSP for media

changelogs/client_server/newsfragments/1600.feature

@@ -0,0 +1 @@
+Recommend that servers set a Content Security Policy for the content repository.

specification/modules/content_repo.rst

@@ -33,6 +33,10 @@ recipient's local homeserver, which must first transfer the content from the
 origin homeserver using the same API (unless the origin and destination
 homeservers are the same).
 
+When serving content, the server SHOULD provide a ``Content-Security-Policy``
+header. The recommended policy is ``default-src 'none'; script-src 'none';
+plugin-types application/pdf; style-src 'unsafe-inline'; object-src 'self';``.
+
 Client behaviour
 ----------------