[JENKINS-76303] Allow showing user avatars when CSP is enforced

[daniel-beck]

https://issues.jenkins.io/browse/JENKINS-76303

Adapt to jenkinsci/jenkins#11269 by allowing the domain hosting avatars as img-src in CSP.

Testing done

None. Plugin doesn't even compile for me, neither JDK 17 nor 21. Same error as in the PR build.

A basic interactive test with mvn hpi:run should allow confirming this works; as CSP is enforced in this mode.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[mrmateo]

None. Plugin doesn't even compile for me, neither JDK 17 nor 21. Same error as in the PR build.

Was able to get it building by updating to newer jenkins dependency versions (for the baseline, bom, and plugin) and then working through versioning between the keycloak transitive dependencies and what is provided by jackson2-api plugin and bouncycastle api plugin. I'll create a separate PR for the dependency updates to fix the builds with the newer jenkins version and then can verify that this PR builds before merging.

[daniel-beck]

Plugin doesn't even compile for me

🤦 I somehow looked at the wrong build statuses and thought that was a pre-existing condition. Thanks for updating things.