Improve security headers

[tmpfs]

https://securityheaders.com/?q=https%3A%2F%2Fstage.uwe.app&followRedirects=on

For the built in server and for the cloudfront proxy.

[tmpfs]

Here is it green https://securityheaders.com/?q=https%3A%2F%2Fwww.feroot.com%2F&followRedirects=on

[tmpfs]

Initial work for the local server is done in 3c1df1f. Requires improvements to support customizing permissions-policy and content-security-policy.

Also need to update the cloudfront setup to add these standard headers.

[tmpfs]

See: https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/

[tmpfs]

Mozilla observatory is also useful: https://observatory.mozilla.org/analyze/tmpfs.org