fix: do not add content-security-policy meta element if content is empty (#10026)

Author: GitRowin

.changeset/heavy-eels-wash.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: do not add content-security-policy meta element if content is empty

packages/kit/src/runtime/server/page/csp.js

@@ -178,8 +178,13 @@ class BaseProvider {
 
 class CspProvider extends BaseProvider {
 	get_meta() {
-		const content = escape_html_attr(this.get_header(true));
-		return `<meta http-equiv="content-security-policy" content=${content}>`;
+		const content = this.get_header(true);
+
+		if (!content) {
+			return;
+		}
+
+		return `<meta http-equiv="content-security-policy" content=${escape_html_attr(content)}>`;
 	}
 }