feature: primary feature-set with limited information disclosure

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
add 'limit buffer size' <= TODO review this!

This needs a desperate review for sanity. Having such a limited client body size for POST requests doesn't seem right. It may need adjustments, it may be correct, it may need profiles, or additional notices in the readme, or be activated by option/profile only.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
add 'timeouts' <= TODO review this too...

ditto to previous commit on review

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
add 'limits' <= TODO another review

fixed SEC-requirement syntax: nginx separates between conn and rate limiting. the requirement apparently expects the connection limit. i added rate limiting defaults for reference and for review.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
fixed formatting to be more readable

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
avoid clickjacking

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
disable content-type sniffing

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
xss filter

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
make hardening configuration configurable

using an array makes this impossible to configure post-mortem. using a map instead gives the user access

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
rubocop

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
Merge pull request #1 from TelekomLabs/first-features

First features