HTTP security hardening headers

[andersk]

From https://securityheaders.com/?q=zulipchat.com&followRedirects=on, we should consider these improvements:

• Content-Security-Policy (Probably the most important by far. We only have this on uploads now. Partial work at csp-django-nonce: Dynamically generate and add nonce to script tags. a3bec61 #9065.)
• X-XSS-Protection: 1; mode=block (nginx: HTTP header fixes #14452)
• X-Content-Options: nosniff (nginx: HTTP header fixes #14452)
• Referrer-Policy?
• Feature-Policy?
• Expect-CT?
• Strict-Transport-Security: includeSubDomains