nginx.conf: set security-related response headers

[macbre]

Inspired by https://github.com/bunkerity/bunkerized-nginx/blob/33e0ffd5b1058fb6e702110f9240dd4703e075a3/misc/variables.env#L106 (resolves #63)

Headers set by default

$ curl 0:8888 -I
HTTP/1.1 200 OK
(...)
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Security-Policy: object-src 'none'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-downloads; base-uri 'self';
(...)