add Content-Security-Policy headers

The config file controls whether CSP is enabled or not, whether it's in report-only or enforce-for-reals mode, and where violation reports are sent.

The local.json-dist config sends reports to the fxa-content-server itself, which listens for POSTs on `/_/csp-violation` and displays them to the logfile. The production.json config currently disables CSP, but when we're ready to flip that switch, we'll be sending violation reports to a mozaws.net server that will collect them for analysis. That server will run `server/bin/csp-violation-server.js`, which is a tiny server that records User-Agent, timestamp, and the violation report, to a logfile for later study.

A small test was added too, which at least confirms that the CSP header is present when it's supposed to be.

The second branch for this won't get tested on travis because it uses `local.json-dist`, which is configured to `report-only`. In order to test the other branch we'd need to restart the server with a different config, but that's a non-trivial change. I'd say it might be best to remove the other branch, make a note and file a new issue about enabling tests for enforcement headers later. Since we aren't going to turn on enforcement for a while, I'd say that's fine.