feat: Middleware to add Content-Security-Policy headers

[timmc-edx]

This replaces https://github.com/edx/edx-arch-experiments/pull/256 and removes some features. First commit is a straight copy of the Python (plus a couple of unrelated fixes), second commit contains unreviewed changes.

Merge checklist:

• [x] Version bumped
• [x] Changelog record added
• [x] Documentation updated (not only docstrings)
• [ ] Commits are squashed

[timmc-edx]

Tests were passing before the previous two commits, but now there's something badly wrong with the codecov package (https://pypi.org/project/codecov/) and CI is broken. But make test, make quality, and make docs all work locally, so I'm going to go ahead and merge.