add security headers to our nginx configuration

[NoamGaash]

We want to allow communication with the following origins:

• self
• google analytics (google-analytics.com, googletagmanager.com)
• fonts.gstatic.com, fonts.googleapis.com
• *.hasadna.org.il

Also, feel free to apply more security best practices (iframes and such)