chore: add headers

[alexiscolin]

Add basic security headers. Feel free to add missed one (or missed properties)

[netlify]

✅ Deploy Preview for govgen-governance-dapp ready!

Name	Link
🔨 Latest commit	4ecc43c
🔍 Latest deploy log	https://app.netlify.com/sites/govgen-governance-dapp/deploys/664ec13862b6de0008e74054
😎 Deploy Preview	https://deploy-preview-91--govgen-governance-dapp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[clockworkgr]

@kristovatlas can you review this as well?

[kristovatlas]

This looks great. Just a couple notes about Content-Security-Policy:

• default-src: 'self' can be used to bypass CSP if the domain hosts JSONP content, Angular.js, or user uploaded files which it probably doesn't.
• Can we set object-src to 'none' ? The object-src directive specifies a source of potentially dangerous HTML elements, such as <object>, <embed>, <applet>, <script>, <frame>, <iframe>, <img>, <style>, <video>, <audio>, and <script>. When set to none, the object-src directive restricts the sources of these elements to none, effectively blocking all inline content from loading. This means that any attempts to load content from an external source will be blocked, and the page will only load content from trusted sources.
• Down the line, we should look into implementing Trusted Types but I wouldn't worry about it for now.

[alexiscolin]

@kristovatlas I've added object-src and made some fix related to inline scripts (broken after the commit).

[kristovatlas]

Looks good, just left 1 in-line comment about a possible typo @alexiscolin

[alexiscolin]

@Stuyk Do you think you could take a look and check if GH discussion works well? I wouldn't like it to be blocked for some reason at some points after the merge.

[clockworkgr]

@Stuyk Do you think you could take a look and check if GH discussion works well? I wouldn't like it to be blocked for some reason at some points after the merge.

@Stuyk ?