GUI-1415: Set CSP header to mitigate XSS attack vectors

Implements https://eucalyptus.atlassian.net/browse/GUI-1415

Note: With the CSP headers in place, all inline scripts (including onclick="…" and href="javascript: …") will be prevented.  The inline scripts formerly included in master_layout.pt have been moved to eucaconsole.js, and the inline script for the security group rules editor JS has been moved to securitygroup_rules.js
@dkavanagh: I'm open to suggestions on where to send the user, since we can't use inline javascript due to the new CSP header.