Use default-src 'self' a.stacker.news (#1349)

This should fix CSP errors in Firefox because scripts fetched via <link rel="prefetch"> don't use script-src.

components/modal.js

@@ -70,7 +70,7 @@ export default function useModal () {
 
     return (
       <Modal
-        onHide={keepOpen ? () => {} : onClose} show={!!content}
+        onHide={keepOpen ? undefined : onClose} show={!!content}
         className={className}
         dialogClassName={className}
         contentClassName={className}

middleware.js

@@ -83,7 +83,7 @@ export function middleware (request) {
 
   const cspHeader = [
     // if something is not explicitly allowed, we don't allow it.
-    "default-src 'none'",
+    "default-src 'self' a.stacker.news",
     "font-src 'self' a.stacker.news",
     // we want to load images from everywhere but we can limit to HTTPS at least
     "img-src 'self' a.stacker.news m.stacker.news https: data: blob:" + devSrc,

prisma/migrations/20240902125646_undelete_bios/migration.sql

@@ -0,0 +1,4 @@
+-- we had a bug where it was possible to delete bios, this migration will restore them
+UPDATE "Item"
+SET "deletedAt" = NULL
+WHERE "bio"