Improve additional security measures

[luclu]

Investigate recommendations from https://observatory.mozilla.org/analyze.html?host=ethereum.org

• [ ] Content Security Policy (Content Security Policy (CSP) header not implemented)
• [ ] X-Frame-Options (X-Frame-Options (XFO) header not implemented)
• [ ] HTTP Strict Transport Security (HTTP Strict Transport Security (HSTS) header not implemented)
• [ ] X-XSS-Protection (X-XSS-Protection header not implemented)
• [ ] Subresource Integrity (Subresource Integrity (SRI) not implemented, but all external scripts are loaded over https)
• [ ] X-Content-Type-Options (X-Content-Type-Options header not implemented)

[peternewnham]

This might give some pointers in how to achieve this https://medium.com/@tom.cook/edge-lambda-cloudfront-custom-headers-3d134a2c18a2