GUI-1415: Set CSP header to mitigate XSS attack vectors

Implements https://eucalyptus.atlassian.net/browse/GUI-1415

Note: With the CSP headers in place, all inline scripts (including onclick="…" and href="javascript: …") will be prevented.  The inline scripts formerly included in master_layout.pt have been moved to eucaconsole.js, and the inline script for the security group rules editor JS has been moved to securitygroup_rules.js
I noticed you changed the functionality here. Since managecreds can be accessed from any page, why would cancel send the user back to the dash?