fixes #7805 - Add several security related HTTP headers - security hardening.

This commit uses secure_headers gem and configures several HTTP
security related headers to be sent by server:
* Content Security Policy
* HTTP Strict Transport Security
* X-XSS-Protection
* X-Frame-Options
* X-Content-Type-Options
All of these enable browser protections on client side and make
exploitation of common web flaws harder.
Fixes #6214 - Alphabetical menu sorting in the UI
refs #7861 - remove trailing whitespace
fixes #7907 - Allow images from gravatar on secure headers
Refs #7587 -  Refactor password confirmation

* confirmation status is now linked to password field
* extracted additional missing strings
* simplified jquery selectors
* switched to onKeyUp built in event
* hide progress bar by default
* fixed minor css
* handle empty pw/confirmation
* moved javascript/stylesheet into partial instead of new/edit
* moved inline js to onContentLoad event.
Fixes #7879 - Update fog to 1.24.0
Fixes #2283 , #3135 - add config option for proxy_request_timeout