feat: Bulk fixes (#1195)

remove ckeditor - not in use
add more strict default password validators
set Django admin as configurable URL
add nginx HSTS and CSP headers
enable moving from private to unlisted in the PORTAL_WORKFLOW private
on default comments listing, show only comments for public media
in case of a private media, dont expose any unneeded metadata

deploy/docker/nginx_http_only.conf

@@ -6,6 +6,26 @@ server {
 
     error_log  /var/log/nginx/mediacms.io.error.log  warn;
 
+    # HSTS header
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # CSP header
+    add_header Content-Security-Policy "
+        default-src 'self';
+        script-src 'self';
+        style-src 'self';
+        img-src 'self' data: blob:;
+        media-src 'self' blob:;
+        frame-src 'self';
+        font-src 'self';
+        connect-src 'self';
+        object-src 'none';
+        frame-ancestors 'self';
+        form-action 'self';
+        base-uri 'self';
+        upgrade-insecure-requests;
+    " always;
+
     location /static {
         alias /home/mediacms.io/mediacms/static ;
     }