apache2 config: fix Content-Security-Policy directive syntax