Improve additional security measures

[luclu]

Investigate recommendations from https://observatory.mozilla.org/analyze.html?host=ethereum.org

• Content Security Policy (Content Security Policy (CSP) header not implemented)
• X-Frame-Options (X-Frame-Options (XFO) header not implemented)
• HTTP Strict Transport Security (HTTP Strict Transport Security (HSTS) header not implemented)
• X-XSS-Protection (X-XSS-Protection header not implemented)
• Subresource Integrity (Subresource Integrity (SRI) not implemented, but all external scripts are loaded over https)
• X-Content-Type-Options (X-Content-Type-Options header not implemented)

[peternewnham]

This might give some pointers in how to achieve this https://medium.com/@tom.cook/edge-lambda-cloudfront-custom-headers-3d134a2c18a2