Important: The partner map allows its tiles under a security policy

Description

The Partners Map content element loads the tiles of its map as images from a tile server, OpenStreetMap by default. The frontend Content Security Policy of TYPO3 allows images from the site itself, data: URLs and the preview images of YouTube and Vimeo only. Once a site enforced that policy, with the feature security.frontend.enforceContentSecurityPolicy for example, the browser blocked every tile, and the markers stayed on an empty map.

The element now extends the directive img-src of the policy of the page it is rendered on by the host of the tile URL the map uses. A host label with a placeholder becomes a wildcard, so the default https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png adds https://*.tile.openstreetmap.org. A page without the element gets no source. The source is registered while TYPO3 renders the page and is kept with the page in the page cache, so a cached page sends it as well.

Impact

On a site that enforces the frontend policy of TYPO3, the map shows its tiles again.
A site that added the host of the tile server to img-src in its csp.yaml can keep that rule or remove it. The source is not added twice.
On TYPO3 13 and newer, a site that renders the element without the data processors of lib.contentElement adds the host of the tile server in its csp.yaml:

config/sites/<site>/csp.yaml
```
mutations:
  - mode: extend
    directive: 'img-src'
    sources:
      - 'https://*.tile.openstreetmap.org'
```
Copied!
A policy that the web server or a proxy sends is not covered. The browser enforces it next to the one of TYPO3, or in its place, so it needs the same source itself.
Behaviour is identical on every supported TYPO3 version.