Extract Bootstrap's inline SVGs to actual resources

Previously, we were required to allow `data:` URLs for img-src in our CSP, since Bootstrap icons were delivered through this mechanism.

config/webpack/webpack.config.js

@@ -24,6 +24,17 @@ const envConfig = module.exports = {
     },
     module: {
         rules: [
+            // Extract Bootstrap's inline SVGs to actual resources.
+            // This removes the requirement for `data:` URLs in our CSP
+            // See https://getbootstrap.com/docs/5.3/getting-started/webpack/#extracting-svg-files
+            {
+                mimetype: 'image/svg+xml',
+                scheme: 'data',
+                type: 'asset/resource',
+                generator: {
+                    filename: 'icons/[hash].svg'
+                },
+            },
             erb
         ]
     },