FEATURE: Expect-CT Header

[lewisgoddard]

As Google is abandoning HPKP in favour of the Expect-CT header, we should implement that instead.

• https://www.theregister.co.uk/2017/10/30/google_hpkp/

This makes things much easier, as it works like CSP but for Certificate Transparency. No more hashing certificates and updating a file.

Expect-CT: max-age=0, report-uri="https://scotthelme.report-uri.io/r/default/ct/reportOnly"
Expect-CT: enforce,max-age=30,report-uri="https://scotthelme.report-uri.io/r/default/ct/enforce"

• https://scotthelme.co.uk/a-new-security-header-expect-ct/

[lewisgoddard]

This should probably be added to nginx-config/directive/bubbly_security-headers.conf

It would be good if this and CSP looked similar:

1. Off by default.
2. Report only, common domains for CSP.
3. On, with warnings.