Sobelow: Implement Policy / Configurations

### Describe the problem you discovered

Though Sobelow concerns were rectified as a result of being ignored or temporarily mitigated, mainly in the web components. We must establish a concrete policy for the production and development environments that takes into consideration proxy, gateways etc.
#641
#702

### Describe the solution you'd like

- [ ] Sobelow.Config.HSTS
- Its is commented under prod at `config :archethic, ArchethicWeb.Endpoint`
- More can be configured using PLig.SSL `ArchethicWeb.Endpoint`

- [ ] Sobelow.Config.CSP:
- `ArchethicWeb.ExplorerRouter`
- `ArchethicWeb.WebUtils `
- default policy prevents metric dashboard from being loaded
```
plug(:put_secure_browser_headers, %{
"content-security-policy" => WebUtils.content_security_policy()
})

```

```
# "default-src 'self' 'unsafe-eval' 'unsafe-inline' ;" <>
# "font-src https://fonts.googleapis.com;" <>
# "style-src-ele https://fonts.googleapis.com/css2?family=Montserrat&display=swap;"
```

- [ ] Sobelow.Config.CSP,
- Explore possibilities for `ArchethicWeb.AEWebRouter`

Review the production and development endpoint configuration, ArchethicWeb.ExplorerRouter, ArchethicWeb.WebUtils, and ArchethicWeb.AEWebRouter; start by checking the referenced Sobelow findings and existing secure-header policy. Done means a concrete policy covers HSTS and CSP for the relevant environments and does not prevent the metric dashboard from loading.

Written by the indexing model from the issue text.