Non-CSP security header + theme color

[toastal]

Because GitHub issue #45 needed to be reverted due to the CSP failing and it being hard to test while we don’t have a staging environment, moving these features to a separate merge request

https://owasp.org/www-project-secure-headers/

• Security headers
  • XSS-Protection
  • Content-type-options: nosniff
  • referrer policy
• Opting out of Google’s FLoC
  • EFF: https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
  • Mozilla: https://blog.mozilla.org/en/privacy-security/privacy-analysis-of-floc/
• Theme color set to Ardana blue instead of the default black