Bug 42080: Invoice PDFs are forced downloads

Serve invoice files with a CSP header that prevents XSS
instead of with an attachment header that turns them into
downloads.

Testing plan:
- Set AcqEnableFiles preference to Do
- Acquisitions > Vendor > Receive Shipment > Create invoice
- Finish Receiving > Manage invoice files
- Upload an SVG with a <script> tag in it
- Click the SVG filename to open it
- Inspect browser's console: it should say something about a
script being blocked due to the CSP directive

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>

acqui/invoice-files.pl

@@ -63,9 +63,9 @@ if ( $op eq 'download' ) {
     my $fname = $file->{'file_name'};
     my $ftype = $file->{'file_type'};
     print $input->header(
-        -type       => $file->{'file_type'},
-        -charset    => 'utf-8',
-        -attachment => $file->{'file_name'}
+        -type                     => $file->{'file_type'},
+        -charset                  => 'utf-8',
+        'Content-Security-Policy' => "default-src 'none'; script-src 'none';"
     );
     print $file->{'file_content'};
 } else {