Secure Headers are not in use

Was looking at the codebase for some stuff I've done in the past and [noticed this](https://github.com/atlassian/github-for-jira/blob/main/src/app.ts#L99):

```
setupFrontendApp(app);
secureHeaders(app);
```

Since it's using the express `use` concept, and that it's "using" _after the router is setup_, that means that all secure headers are essentially ignored until after the routes are completed, which means that this isn't securing anything.

I'm not sure what's being accomplished by having the security headers in a separate function since it's only used once? Why not just add it inline with all other express app settings _right before_ the router is used?


The relevant middleware order is in src/app.ts around line 99; read how setupFrontendApp, secureHeaders, and the router are registered. Confirm secureHeaders is registered before route handling, then run the repository's existing checks to verify the security headers are applied.

Written by the indexing model from the issue text.