[BUG] Add comprehensive security headers to improve website protection

### Describe the bug.

The AsyncAPI website does not include several commonly recommended security headers that protect against well-known web vulnerabilities.

Specifically:
- No Content Security Policy (CSP) header is present
- No clear security header configuration is defined in the Next.js setup
- Browser developer tools do not show headers related to XSS protection, clickjacking prevention, or strict content handling

This is a configuration-level issue that affects the overall security posture of the website.

### Expected behavior

The website should include a standard set of security headers, such as:
- Content-Security-Policy (CSP)
- X-Content-Type-Options
- X-Frame-Options or `frame-ancestors` via CSP
- Referrer-Policy
- Permissions-Policy
- Strict-Transport-Security (HSTS)

These headers should be consistently applied across all pages to reduce exposure to common client-side attacks.

### Screenshots

Not applicable.

This issue is related to HTTP response headers and configuration rather than a visual UI bug.
The absence of headers can be verified via browser DevTools → Network → Response Headers.

### How to Reproduce

1. Open the AsyncAPI website in a browser.
2. Open Developer Tools.
3. Navigate to the "Network" tab.
4. Reload the page.
5. Click on the main document request.
6. Inspect the "Response Headers" section.
7. Observe that security headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options are missing.

### 🖥️ Device Information [optional]

- Operating System (OS): Windows 10
- Browser: Google Chrome
- Browser Version: 135.0

### 👀 Have you checked for similar open issues?

- [x] I checked and didn't find similar issue

### 🏢 Have you read the Contributing Guidelines?

- [x] I have read the [Contributing Guidelines](https://github.com/asyncapi/.github/blob/master/CONTRIBUTING.md)

### Are you willing to work on this issue ?

Yes I am willing to submit a PR!

Start by reviewing the Next.js setup and inspect the main document request in browser DevTools to establish the current response headers. Add the requested security headers consistently across pages, then verify the response headers include the agreed CSP, clickjacking, content-type, referrer, permissions, and transport-security protections.

Written by the indexing model from the issue text.