[Config] Security headers

[emmanuelgautier]

Description

Check for missing or weak HTTP security headers.

Checks to implement

• CSP missing or unsafe-inline
• HSTS missing or max-age too short
• X-Frame-Options / frame-ancestors absent
• X-Content-Type-Options missing
• Permissions-Policy not set

Tier rationale

Static header inspection on a single response.