Add HTTP security headers

[neilbmclaughlin]

Concern over the lack of security headers has been raised by others.

While I don't think we have any security vulnerabilities, since we have no exposure to XSS (nunjucks sanitises input) and do not have sensitive data or sessions tokens, it seems prudent to introduce these best practice measures sooner rather than later.

[st3v3nhunt]

I think this is all sorted now via a number of PRs including:

• 🚒 Remove X-Powered-By and Server headers #178
• Feature/security tests #177
• Feature/more headers #170
• 🔐 Refine security headers #167
• 🔒 Add security headers #166

@neilbmclaughlin Can this be closed?

[st3v3nhunt]

Closing as it has been rectified.