Add security measures

[jbmoelker]

What security measures should we add?

• basic security headers.
• allowlist hosts for dev and preview servers?
• check origin protection as a basic csrf protection. It's a simple Astro config option. Returns 403 if origin does not match. Should we return a 403 page like we do for 404? Could share an Error Page model as suggested in Custom 500 error pages #158 for 500 pages.
• Astro env to restrict access (server/client; public) and type-safety of env variables.
• Astro Shield to add Subresource Integrity and Content Security Policy (CSP) headers.
• Astro Utils to add CSRF token protection to forms. Note: may not be compatible with Cloudflare adapter
• ...

[jbmoelker]

Astro supports native CSP since v5.9 (experimental):
https://docs.astro.build/en/reference/experimental-flags/csp/