Apollo Sandbox cannot be loaded
### Issue Description

Hi there,

I am using NestJs and added a GraphQL endpoint. I [migrated](https://docs.nestjs.com/graphql/migration-guide) to @apollo/server 4.7.5

The endpoint itself works well with GraphiQL etc. but I cannot access the Apollo Sandbox (playground):

> Welcome to Apollo Server
> Apollo Sandbox cannot be loaded; it appears that you might be offline.

In my browser console, I see the following errors:

> Refused to load the image 'https://apollo-server-landing-page.cdn.apollographql.com/_latest/assets/favicon.png' because it violates the following Content Security Policy directive: "img-src 'self' data:".

> graphql:22 Refused to load the image 'https://apollo-server-landing-page.cdn.apollographql.com/_latest/assets/favicon.png' because it violates the following Content Security Policy directive: "img-src 'self' data:".
> 
> graphql:1 Refused to load the script 'https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js?runtime=%40apollo%2Fserver%404.7.4' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
> 
> graphql:71 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-OK7pAH5PWuMz0B3Z+8KJD+AVvhgLxb2X4W00TmJw2M8='), or a nonce ('nonce-...') is required to enable inline execution.
> 
> Refused to load the image 'https://apollo-server-landing-page.cdn.apollographql.com/_latest/assets/favicon.png' because it violates the following Content Security Policy directive: "img-src 'self' data:".
> 
> graphql:1 Refused to load manifest from 'https://apollo-server-landing-page.cdn.apollographql.com/_latest/manifest.json' because it violates the following Content Security Policy directive: "default-src 'self' Note that 'manifest-src' was not explicitly set, so 'default-src' is used as a fallback.

I tried the setup described in https://docs.nestjs.com/graphql/quick-start#apollo-sandbox and added:

```js
playground: false,
      plugins: [
        ApolloServerPluginLandingPageLocalDefault({
          headers: {
            'Content-Security-Policy':
              "default-src 'self' https://embeddable-sandbox.cdn.apollographql.com/;",
          },
        }),
      ],
```

In HTML, it looks like follows:

```html
```html
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-b5693f538f65c3b4938853dfcf85ff99c16ab6ef4dc5341e87b0c69ccbafa012' https://apollo-server-landing-page.cdn.apollographql.com https://embeddable-sandbox.cdn.apollographql.com https://embeddable-explorer.cdn.apollographql.com; style-src 'nonce-b5693f538f65c3b4938853dfcf85ff99c16ab6ef4dc5341e87b0c69ccbafa012' https://apollo-server-landing-page.cdn.apollographql.com https://embeddable-sandbox.cdn.apollographql.com https://embeddable-explorer.cdn.apollographql.com https://fonts.googleapis.com; img-src https://apollo-server-landing-page.cdn.apollographql.com; manifest-src https://apollo-server-landing-page.cdn.apollographql.com; frame-src https://explorer.embed.apollographql.com https://sandbox.embed.apollographql.com https://embed.apollo.local:3000" />
 
...

<script nonce="b5693f538f65c3b4938853dfcf85ff99c16ab6ef4dc5341e87b0c69ccbafa012">

  var initialEndpoint = window.location.href;
  var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{"headers":{"Content-Security-Policy":"default-src \u0027self' https://apollo-server-landing-page.cdn.apollographql.com;"}},"hideCookieToggle":false,"endpointIsEditable":false,"runtime":"@apollo/server@4.7.5","runTelemetry":true,"allowDynamicStyles":false};
  new window.EmbeddedSandbox(
   {
   ...embeddedSandboxConfig,
   initialEndpoint,
   }
   );
   </script>


```

I think this is a security configuration problem because the browser prevents the loading of the scripts.
So either the config does not take effect or I just put in the wrong options.

This seems to be a known issue, see the original issue below.


### Link to Reproduction

https://github.com/graphql/graphql-playground/issues/1283#issuecomment-1292153300

### Reproduction Steps

I am aware that this is not an actually reproducible bug report. But since this seems to be a known issue, could you please guide me to the correct place? Thx!