[Feature]: 使用helmet中间件自定义http安全策略

[baozhoutao]

Summary 摘要

1 通过环境变量启用helmet中间件: STEEDOS_HTTP_ENABLED_HELMET=true 默认值为false
2 通过使用项目根路径下的steedos.config.js中settints.helmet = {...} 来显示自定义helmet配置. 例如:

...
settings: {
    helmet: {
	contentSecurityPolicy: false,
	crossOriginEmbedderPolicy: false,
	crossOriginOpenerPolicy: false,
	crossOriginResourcePolicy: false,
    }
...
}
...

helmet 使用文档: https://helmetjs.github.io/#get-started

Why should this be worked on? 此需求的应用场景？