Add some security headers, including CSP and HPKP

It would be nice to have some security headers: https://securityheaders.io/?q=https%3A%2F%2Fgethttpsforfree.com%2F

Especially a CSP could be very helpful here, as you can very strictly limit the JS use. However you may have to rewrite a few JS parts to be CPS-compatible (to not have to allow `insecure-eval`).
Also have a look at [report-uri](https://report-uri.io/) where you can collect CPS and HPKP violation reports.

As for HPKP [please be cautious with the LE client](https://community.letsencrypt.org/t/http-public-key-pinning-hpkp/2450). You might want to follow [this best practises](https://community.letsencrypt.org/t/hpkp-best-practices-if-you-choose-to-implement/4625).

先查看 issue 中連結的 securityheaders.io 報告，然後檢查此專案如何提供 Web 回應和 JavaScript。在可能的情況下定義不含 insecure-eval 的 CSP，根據連結的指南評估所要求的 report-uri 和 HPKP 設定，並驗證最終的 header 和用戶端行為符合安全性目標。

由索引模型根據 Issue 內容生成。