[Templating] Add a CSP meta header to our template layouts

We can add a reasonable CSP policy in the meta tag of our layouts to tighten the security of our templates by default to allow only thing in our same origin and from the sources that we include by default in our template.

This gives us a bunch of benefits.
* Better CSRF protection
* Better XSS protection
* Better HTTPS support with upgrade-insecure-requests (which helps with integrity and confidentiality) and helps our users avoid mixed content and get the green padlock in the address bar.

It's pretty visible for our users so they can change it in one place.
* If we add a `@section`, the policy can be overridden by a specific page.

/cc @blowdart