Skip setting CSP header on resource root URL request

[daniel-beck]

Since #18, CSP headers are also set for files served by DirectoryBrowserSupport from "Resource Root URL" requests when that shouldn't be the case.

This probably still clashes in some way with hudson.model.DirectoryBrowserSupport.CSP, TBD exactly (but that seems like a reasonable tradeoff, just needs to be documented).

Testing done

Freestyle job with shell build step echo '<script>alert(1)</script>' > index.html. Navigate to the file in the workspace browser. With RRURL set, the script executes (as intended, was regressed), otherwise does not (as intended).

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[basil]

Sorry about that and thanks for fixing this so quickly.