Add security guidelines to README

- set CSP to avoid XSS attacks https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
- suggest setting budgets where possible (e.g. with Alby NWC) - _note: need to add support in Bitcoin Connect to pass those parameters_
- ?

Start with the README and the linked CSP guidance, then inspect how Bitcoin Connect currently handles Alby NWC parameters. Clarify whether budget-parameter support is part of this issue or a prerequisite. Done means the agreed security guidance is documented and any explicitly included support work has a clear verification path.

Written by the indexing model from the issue text.