Add Content-Security-Policy header to vercel responses

[fennifith]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Pages should have a Content-Security-Policy to prevent unintentional script execution from other domains.

Consider adding other headers such as those defined by express helmet as a good practice.

https://github.com/josh-hemphill/vite-plugin-csp

• not sure if the above can be used when hosted on Vercel; this might just need configuration through vercel.json