Fixes #19789 - fix Layout/SpaceAroundOperators cop

Fixes #17084 - Add webpack on welcome and unauthorized pages

Adds webpack server to CSP headers via prepend_before_action,
to ensures it is run before welcome and authorized filters.

Fixes #16566 - Allow css inline images

Secure headers currently prevents inlining images in CSS using the
'data:' method. This commit adds that to the allowed image sources.

Fixes #9117 - Upgrade secure_headers to version 3.4

Any plugin that makes changes to secure headers may need to be updated
to correctly handle this upgrade, as there have been some breaking
changes to the secure_headers api.