chore(docs): use SetEnv CSP_PROJECT_DOMAINS format for ASF compliance

Updates .htaccess to use the ASF-required format for CSP overrides:
- Use SetEnv CSP_PROJECT_DOMAINS instead of Header set Content-Security-Policy
- Document each required domain with its purpose
- Reference ASF CSP documentation

Required domains:
- widget.kapa.ai: AI chatbot widget
- *.googleapis.com, *.google.com, *.gstatic.com: Google Calendar, reCAPTCHA
- *.github.com, *.githubusercontent.com: GitHub images in docs
- *.algolia.net, *.algolianet.com: Algolia DocSearch

Fixes: https://github.com/apache/superset/issues/35845

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>