pub const UNSAFE_EVAL: &str = "'unsafe-eval'";
'unsafe-eval': allows eval and new Function (htmx’s hx-on and js: need it). Avoid it.
'unsafe-eval'
eval
new Function
hx-on
js:
assert_eq!(ocre::security::UNSAFE_EVAL, "'unsafe-eval'");