Docs: Applying content security policy with middleware breaks if Chrome preloads page

### What is the documentation issue? The docs here recommend a matcher that causes the middleware to not run, and therefore CSP to not be applied, if Chrome preloads the page. ### Is there any context that might help us understand? ``` missing: [ { type: 'header', key: 'next-router-prefetch' }, { type: 'header', key: 'purpose', value: 'prefetch' }, ], ``` ### Does the docs page already exist? Please link to it. https://nextjs.org/docs/app/guides/content-security-policy