feat: add Python and Java regex engines

scripts/serve-test.mjs

@@ -26,6 +26,14 @@ const testCatalogue = {
   theme: { mode: "system", brand: "add·ideas" },
   apps: [{ manifest: "./toolbox-app.json", enabled: true }],
 };
+const productionSecurityHeaders = {
+  "Content-Security-Policy":
+    "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'",
+  "Cross-Origin-Embedder-Policy": "require-corp",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "X-Content-Type-Options": "nosniff",
+};
 
 function safeFile(requestPath) {
   const decoded = decodeURIComponent(requestPath);
@@ -50,6 +58,7 @@ const server = createServer(async (request, response) => {
       response.writeHead(200, {
         "Content-Type": "application/json; charset=utf-8",
         "Cache-Control": "no-cache",
+        ...productionSecurityHeaders,
       });
       response.end(JSON.stringify(testCatalogue));
       return;
@@ -66,7 +75,7 @@ const server = createServer(async (request, response) => {
       "Content-Type":
         mediaTypes.get(path.extname(file)) ?? "application/octet-stream",
       "Cache-Control": "no-cache",
-      "Cross-Origin-Resource-Policy": "same-origin",
+      ...productionSecurityHeaders,
     });
     response.end(content);
   } catch {