Add several security related HTTP headers - security hardening.

This commit uses secure_headers gem and configures several HTTP
security related headers to be sent by server:
* Content Security Policy
* HTTP Strict Transport Security
* X-XSS-Protection
* X-Frame-Options
* X-Content-Type-Options
All of these enable browser protections on client side and make
exploitation of common web flaws harder.

Options, especially CSP ones, can be made more restrictive in the future, which I refrain from doing right now to not introduce regressions.