[docs] Add Apollo script

[paulOsinski]

Adds Apollo JS to documentation (used by DD Inc)

[dryrunsecurity]

This pull request adds external JavaScript loads from static.reo.dev and assets.apollo.io in docs/layouts/_partials/head/script-header.html without Subresource Integrity (SRI) protection, creating a supply-chain risk where a compromise of those providers could lead to XSS or data theft (made worse by a dynamic nocache parameter that prevents a stable SRI hash). Consider adding SRI hashes where possible, avoiding dynamic cache-busting parameters for third‑party scripts, or self‑hosting/mitigating the dependency to reduce the risk.

Third-Party Script Inclusion / Supply Chain Risk in docs/layouts/_partials/head/script-header.html

Vulnerability

Third-Party Script Inclusion / Supply Chain Risk

Description

The code loads JavaScript from two external domains (static.reo.dev and assets.apollo.io) without Subresource Integrity (SRI) checks. This creates a supply chain risk. If either of these third-party services is compromised, malicious JavaScript could be executed on this site, leading to attacks like Cross-Site Scripting (XSS) or data theft. The dynamic nocache parameter for the Apollo script further complicates the use of static SRI hashes.

django-DefectDojo/docs/layouts/_partials/head/script-header.html

Lines 1 to 12 in 73492b8

	<!-- Insert scripts NOT needed by stylesheets here -->
	<!-- Start of Reo Javascript -->
	<script type="text/javascript">
	!function () { var e, t, n; e = "a92cfcfa51eca96", t = function () { Reo.init({ clientID: "a92cfcfa51eca96" }) }, (n = document.createElement("script")).src = "https://static.reo.dev/" + e + "/reo.js", n.async = !0, n.onload = t, document.head.appendChild(n) }();
	</script>
	<!-- End of Reo Javascript -->
	<script>function initApollo() {
	var n = Math.random().toString(36).substring(7), o = document.createElement("script");
	o.src = "https://assets.apollo.io/micro/website-tracker/tracker.iife.js?nocache=" + n, o.async = !0, o.defer = !0,
	o.onload = function () { window.trackingFunctions.onLoad({ appId: "68ffca00b8c4dc001de5fec3" }) },
	document.head.appendChild(o)
	} initApollo();</script>

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved