feat: Misc ZAP Updates

[afwilcox]

Description

Please provide a summary of the change and the issue fixed. Please include relevant context. List dependency changes.

Made some changes to the Caddy File and Libraries in order to address the following vulnerabilities:
- CSP: Wildcard Directive
- CSP: script-src unsafe-eval
- CSP: script-src unsafe-inline
- Dangerous JS Function (Upgraded library)
- Deprecated Feature Policy Header Set

Updated the GitHub actions to do the following:

• Removed ZAP from scheduled scans and added into PR workflow
• Fail Action if a High Severity issue is found

The following ZAP reports were unable to be resolved:

• CSP: style-src unsafe-inline: This is part of font awesome, and doesn't seem to work without it. See this GitHub Issue: SVG Symbols violate strict CSP style-src directives FortAwesome/Font-Awesome#16827
• Hidden File Found: This is because our custom error page is triggered which does not return 404 error code
• Proxy Disclosure: Suspect this is possibly coming from OpenShift is there is nothing sensitive in the headers, and attempting to disable OPTIONS, TRACE and TRACK in Caddy did not resolve the issue
• Cookie with SameSite Attribute None: This is a Keycloak Cookie
• Insufficient Site Isolation Against Spectre Vulnerability: Patching this will allow the authentication redirects to not function properly.
• Timestamp Disclosure: This is a false positive as a result of some code in the Keycloak library
• Information Disclosure: Suspicious Comments: - this is coming from a third party library where a comment contains the word 'bug'
• Modern Web Application: Yes, this is a modern web application...
• Non Storable Content: This is intentional as we don't want to allow anything to be cached
• Sec-Fetch-Dest Header is Missing: Adding Header did not resolve issue, possibly being flagged from something else?
• Sec-Fetch-Mode Header is Missing: Adding Header did not resolve issue, possibly being flagged from something else?
• Sec-Fetch-Site Header is Missing: Adding Header did not resolve issue, possibly being flagged from something else?
• Sec-Fetch-User Header is Missing: Adding Header did not resolve issue, possibly being flagged from something else?
• Session Management Response Identified: As per ZAP this is informational only

Fixes # (issue)

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Further comments

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jon-funk]

Really appreciate the work on this, always nice to do cleanup, improve standards and workflows.

Reading through the leftover ZAPs, none stick out as concerning. As with most policy tools you get some noise.

[jon-funk]

Really clever use of jq in the zap report output!