add security headers

[travi]

https://securityheaders.io/?q=admin.travi.org&followRedirects=on

• [x] Strict-Transport-Security
• Content-Security-Policy
  • [x] -Report-Only
  • [x] activate
  • [x] support webpack dev server locally
  • [ ] require-sri-for script style
• [ ] Public-Key-Pins
• [x] X-Frame-Options
• [x] X-XSS-Protection
• [x] X-Content-Type-Options
• [ ] Referrer-Policy
• [ ] Expect-CT

[travi]

https://github.com/nlf/blankie

[travi]

subresource-integrity

• https://www.npmjs.com/package/webpack-subresource-integrity
• https://github.com/nlf/blankie#options
• https://scotthelme.co.uk/enforcing-the-use-of-sri/