Add a handful of initial security directives for Nginx

Adds:
* X-Content-Type-Options
* X-XSS-Protection
* X-Frame-Options

Prevents access to a variety of config/backup file extensions.

We can explore the addition of Content Security Policy headers at a later time.