Add Content Security Policy boilerplate to `.htaccess` 

As @mikewest is probably [busy](https://github.com/h5bp/html5-boilerplate/pull/1265#issuecomment-11916463), I've moved the [CSP pull request](https://github.com/h5bp/html5-boilerplate/pull/1265) here but, until it's pulled in, I think it would be nice to get some feedback.

(Right now the default configuration is pretty restrictive so, one question might be: **do we leave it as it is or make it less / even more restrictive ?**)

--- 

Previous discussions: 
* [#1265](https://github.com/h5bp/html5-boilerplate/pull/1265)  
* [#1258](https://github.com/h5bp/html5-boilerplate/pull/1258)

Useful links: 
* http://html5rocks.com/en/tutorials/security/content-security-policy/ 
* http://w3.org/TR/CSP