gitlab-ce/lib/gitlab/content_security_policy
..
config_loader.rb