fix: serve s3 proxy objects with nosniff and a sandbox csp (#11731)

* fix: serve s3 proxy objects with nosniff and a sandbox csp

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: assert s3 proxy error responses carry nosniff and the sandbox csp

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 196abc042c691ea16280ee10b89fb3b2fd527236

This commit updates the EE repository reference after PR #876 was merged in windmill-ee-private.

Previous ee-repo-ref: 25feaf41aa84d47f8e4adb4def2576b443a66374

New ee-repo-ref: 196abc042c691ea16280ee10b89fb3b2fd527236

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-118785eaa78675089b9a676d24e5d0a2e03f3d9a
+196abc042c691ea16280ee10b89fb3b2fd527236

backend/tests/s3_proxy_headers.rs

@@ -0,0 +1,29 @@
+//! Every s3_proxy response carries `nosniff` and the sandbox CSP, error responses included,
+//! since the presigned route serves workspace objects from the app origin without a login.
+#![cfg(all(feature = "enterprise", feature = "private", feature = "parquet"))]
+
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+#[sqlx::test(fixtures("base"))]
+async fn test_s3_proxy_sets_content_security_headers(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/s3_proxy/_default_/x.html?exp=9999999999&sig=00"
+        ))
+        .send()
+        .await?;
+
+    assert!(resp.status().is_client_error(), "status: {}", resp.status());
+    assert_eq!(resp.headers()["x-content-type-options"], "nosniff");
+    assert_eq!(
+        resp.headers()["content-security-policy"],
+        "sandbox allow-scripts allow-forms allow-popups allow-modals allow-downloads"
+    );
+    Ok(())
+}