Harden low CSP script inclusion

[r1kka6]

Summary

• reduce the low CSP policy to script-src 'self' so attacker-publishable CDN origins are no longer trusted
• stop reflecting arbitrary include values into <script src> and allow only a fixed same-origin helper script
• guard against array input so malformed include[]=x requests do not turn the hardening into a 500

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/csp/source/low.php
• vulnerable baseline emits a jsDelivr attacker URL as a script tag while the CSP header allows jsDelivr
• patched runtime returns Content-Security-Policy: script-src 'self';, omits the external attacker script tag, still allows source/impossible.js, and keeps include[]=x at 200