Add HTTP Security Headers

[domenukk]

Some basic security considerations should be made, such as csps with "no inline javascript", x-frame-options: SAMEORIGIN and others.
For more infos, see
https://www.keycdn.com/blog/http-security-headers
https://pentest-tools.com/blog/essential-http-security-headers/

[Trolldemorted]

Do we want more headers or can we close this?

[domenukk]

There are probably 20 more I don't know about but we can close this issue :)