freezing the RESPONSE_HEADERS constant

Freezing the `RESPONSE_HEADERS` would help prevent unintended modifications.
While this constant should definitely be merged into the headers, if someone ever did:

```ruby
request.headers = @oauth2.response_headers
```

The `request.headers` would become a pointer to the constant, so adding or modifying any headers after this would actually modify the constant

Tests pass with https://github.com/songkick/oauth2-provider/pull/74