Fix CSP for dapps that require eval. (#7867)

* Add allowJsEval to manifest.

* Enable 'unsafe-eval' if requested in manifest.

dapps/src/handlers/echo.rs

@@ -40,7 +40,7 @@ impl Into<hyper::Response> for EchoHandler {
 			.with_header(content_type.unwrap_or(header::ContentType::json()))
 			.with_body(self.request.body());
 
-		add_security_headers(res.headers_mut(), None);
+		add_security_headers(res.headers_mut(), None, false);
 		res
 	}
 }