Content-secutiry-policy header is blocking the pdf preview from rendering inside an iframe

With the recent upgrade to coko-server v4, some header were added to the microservice response that prevent the pdf preview from rendering inside an iframe.

content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests

I have encountered the same issue in flax (that is also using coko-server v4), and the solution i've there got is:

res.removeHeader('Content-Security-Policy')

For pagedjs this needs to be added in the removeFrameGuard method here: https://gitlab.coko.foundation/cokoapps/pagedjs/-/blob/main/server/api/helpers.js#L34