GUI-1415: Set CSP header to mitigate XSS attack vectors

Implements https://eucalyptus.atlassian.net/browse/GUI-1415

Note: With the CSP headers in place, all inline scripts (including onclick="…" and href="javascript: …") will be prevented.  The inline scripts formerly included in master_layout.pt have been moved to eucaconsole.js, and the inline script for the security group rules editor JS has been moved to securitygroup_rules.js
I think we could have kept the functionality intact with some javascript in the controller using ng-click, right?