GeezerVison

Bump Version to 7.3.0 (#593)

Includes GHSA-rqq5-2gf9-4w4q fix

Co-authored-by: Kylie Stradley <[email protected]>

Bump Version to 7.2.0 (#581)

Bump the release version to `7.2.0` and bump the ruby version so we can
use `release-gem` to publish the gem to rubygems.

Update version

Upgrade version and docs to 7.0 (#528)

## All PRs:

* [x] Has tests
* [x] Documentation updated

## Adding a new header

N/A

## Adding a new CSP directive

N/A

Closes #480

Make SecureSecurityPolicyConfig significantly faster (#506)

We have been seeing this gem a lot in profiles. Must of this slowness
seems to come from overuse of instance variables in `DynamicConfig` and
attempting to use them basically as a hash (which we can do much faster
with a hash 😅)

The first commit of these is the most important, but the other two also
significantly speed things up.

There is definitely more improvement available here, we seem to be
overly cautious in duplicating arrays, and we also seem to convert
unnecessarily between hashes and the config object, but I think this is
the best place to start.

<details>
<summary>Benchmark:</summary>

```
require "secure_headers"
require "benchmark/ips"

# Copied from README
MyCSPConfig = SecureHeaders::ContentSecurityPolicyConfig.new(
  preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
  disable_nonce_backwards_compatibility: true, # default: false. If false, `unsafe-inline` will be added automatically when using nonces. If true, it won't. See #403 for why you'd want this.

  # directive values: these values will directly translate into source directives
  default_src: %w('none'),
  base_uri: %w('self'),
  block_all_mixed_content: true, # see https://www.w3.org/TR/mixed-content/
  child_src: %w('self'), # if child-src isn't supported, the value for frame-src will be set.
  connect_src: %w(wss:),
  font_src: %w('self' data:),
  form_action: %w('self' github.com),
  frame_ancestors: %w('none'),
  img_src: %w(mycdn.com data:),
  manifest_src: %w('self'),
  media_src: %w(utoob.com),
  object_src: %w('self'),
  sandbox: true, # true and [] will set a maximally restrictive setting
  plugin_types: %w(application/x-shockwave-flash),
  script_src: %w('self'),
  script_src_elem: %w('self'),
  script_src_attr: %w('self'),
  style_src: %w('unsafe-inline'),
  style_src_elem: %w('unsafe-inline'),
  style_src_attr: %w('unsafe-inline'),
  worker_src: %w('self'),
  upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
  report_uri: %w(https://report-uri.io/example-csp)
)


Benchmark.ips do |x|
  x.report "csp_config.to_h" do
    MyCSPConfig.to_h
  end

  x.report "csp_config.append" do
    MyCSPConfig.append({})
  end

  x.report "new(config).value" do
    SecureHeaders::ContentSecurityPolicy.new(MyCSPConfig).value
  end
end
```

</details>


**Before:**

```
$ be ruby bench.rb
Warming up --------------------------------------
     csp_config.to_h    13.737k i/100ms
   csp_config.append     2.105k i/100ms
   new(config).value     1.429k i/100ms
Calculating -------------------------------------
     csp_config.to_h    139.988k (± 0.3%) i/s -    700.587k in   5.004666s
   csp_config.append     21.133k (± 2.4%) i/s -    107.355k in   5.082856s
   new(config).value     14.298k (± 0.4%) i/s -     72.879k in   5.097116s
```


**After:**

```
$ be ruby bench.rb
Warming up --------------------------------------
     csp_config.to_h   123.784k i/100ms
   csp_config.append     4.181k i/100ms
   new(config).value     1.617k i/100ms
Calculating -------------------------------------
     csp_config.to_h      1.238M (± 3.1%) i/s -      6.189M in   5.003769s
   csp_config.append     40.921k (± 1.0%) i/s -    204.869k in   5.006924s
   new(config).value     16.095k (± 0.4%) i/s -     80.850k in   5.023259s
```

`to_h` is 10x faster, `append` is 2x faster, and .value (which was not
the target of these optimizations but I didn't want to see it regress)
is slightly faster

---------

Co-authored-by: Kylie Stradley <[email protected]>

deprecate block-all-mixed-content (#509)

v6.5.0 (#501)

Release notes:

- CSP: Remove source expression deduplication. (@lgarron)
#499

Version 6.4.0

Merge pull request #487 from github/release-v6.3.4

Update changelog and version for v6.3.4.

Version 6.3.3