Content Security Policy is only active for HTML responses but not for image/svg+xml

Ruby on Rails disclosed a bug submitted by thorsteneckel: https://hackerone.com/reports/1327196