Enable security headers by default

[Badgerati]

In Pode 2.6.0 there was a new feature added to enable security headers in middleware. In Pode.Web, we should enable most of these by default (but with the option to turn them off). This includes headers like CORS, X-Frame, Permission-Policy, etc.

(This should only be done if the installed Pode module is v2.6.0, so either this is the new required version, or we just check the version).

On Use-PodeWebTemplate there should be a new -Security parameter, with possible options: None, Default, Simple, Strict.

• None: no security headers
• Default: use inbuilt Simple, but "default-src" for Content Security should alllow http/s, and CORS should be open
• Simple: use inbuilt Simple
• Strict: use inbuilt Strict

For Default, Simple, and Strict, all 3 will need extra options being enabled to support some features/structure of Pode.Web:

Add-PodeSecurityContentSecurityPolicy `
    -Style 'self', 'unsafe-inline' `
    -Scripts 'self', 'unsafe-inline' `
    -Image 'self', 'data'

There should also be a -UseHsts switch, so people can optionally enable the Strict-Transport-Security header.

Default will be the Default enabled. To disable:

Use-PodeWebTemplates -Security None

Or to use Simple:

Use-PodeWebTemplates -Security Simple

Or to use Strict with HSTS:

Use-PodeWebTemplates -Security Strict -UseHsts