feat: added security headers

[ilayda-cp]

Done

Added security headers.

• Content-Security-Policy: Restrict resources (e.g., JavaScript, CSS, Images) and URLs
• Referrer-Policy: Limit referrer data for security while preserving full referrer for same-origin requests
• Cross-Origin-Embedder-Policy: allows embedding cross-origin resources
• Cross-Origin-Opener-Policy: enable the page to open pop-ups while maintaining same-origin policy
• Cross-Origin-Resource-Policy: allowing cross-origin requests to access the resource
• X-Permitted-Cross-Domain-Policies: disallows cross-domain access to resources

Read more from here.

QA

• Open : https://canonical-com-1396.demos.haus/
• Verify no security header error is shown in the console.
• Verify all the images, videos, iframes and other resources are shown correctly
• Verify there is no behavior change (such as a link doesnt open)
• Open header analyzer
• Verify Referrer-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and X-Permitted-Cross-Domain-Policies headers arent missing

Issue / Card

Fixes #14453, #14454, #14455, #14456, #14457, #14458

[webteam-app]

Demo

Jenkins

demos.haus