feat: establish reproducible FreeCAD web compatibility baseline

config/security-baseline.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 1,
+  "browserScope": "chrome-only",
+  "headersPath": "public/_headers",
+  "requiredHeaders": {
+    "Cross-Origin-Opener-Policy": "same-origin",
+    "Cross-Origin-Embedder-Policy": "require-corp",
+    "Cross-Origin-Resource-Policy": "same-origin",
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()"
+  },
+  "contentSecurityPolicy": {
+    "default-src": ["'self'"],
+    "script-src": ["'self'", "'wasm-unsafe-eval'"],
+    "worker-src": ["'self'", "blob:"],
+    "connect-src": ["'self'"],
+    "object-src": ["'none'"],
+    "base-uri": ["'self'"],
+    "frame-ancestors": ["'none'"]
+  },
+  "forbiddenSourcePatterns": ["dangerouslySetInnerHTML", "new Function(", "eval("]
+}