add Content-Security-Policy headers

The config file controls whether CSP is enabled or not, whether it's in report-only or enforce-for-reals mode, and where violation reports are sent.

The local.json-dist config sends reports to the fxa-content-server itself, which listens for POSTs on `/_/csp-violation` and displays them to the logfile. The production.json config currently disables CSP, but when we're ready to flip that switch, we'll be sending violation reports to a mozaws.net server that will collect them for analysis. That server will run `server/bin/csp-violation-server.js`, which is a tiny server that records User-Agent, timestamp, and the violation report, to a logfile for later study.

A small test was added too, which at least confirms that the CSP header is present when it's supposed to be.

The report server will probably only be used in staging, as we gather a baseline of violations (to figure out when it's appropriate to turn this stuff on in prod). I'm hoping we'll have a better report server implemented before we turn CSP on in a wider audience. So this server doesn't need to be very sophisticated, but we do need *something* running to be able to turn on CSP reports and start gathering information.