feat(cloudfront): reportOnly flag on ResponseHeadersContentSecurityPolicy

[dillonstreator]

Issue #29006

Closes #29006.

Reason for this change

Improve ergonomics/discoverability/DX of CSP Report Only configuration

Description of changes

Added an optional reportOnly field on ResponseHeadersContentSecurityPolicy that maps the CSP to a custom header.

Description of how you validated changes

Added a unit test

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[dillonstreator]

Exemption Request:
I may be missing something but I don't think the following check applies to this change. I couldn't find a relevant integration test or snapshot.

❌ Features must contain a change to an integration test file and the resulting snapshot.

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[dillonstreator]

In regard to your exemption request, I'd like to see an integ test that uses the settings you're adding so that we know it deploys just fine.

@TheRealAmazonKendra - could you point me in the right direction here? I couldn't find an existing integration test that covered ResponseHeadersPolicy, leading me to believe this should be exempt.

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: daa3037
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[aws-cdk-automation]

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

✅ A exemption request has been requested. Please wait for a maintainer's review.