Set `default-src` CSP Attribute to `none` by default

At GitHub, we set the `default-src` CSP attribute to `none`. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted.

It would be desirable to set this default in `secure_headers` as well:

https://github.com/github/secure_headers/blob/7f89df2dafb22f1833702eef4a01d4794b2066f0/lib/secure_headers/headers/content_security_policy_config.rb#L133

This would be a breaking change, so if this is desirable, this would fit well in with https://github.com/github/secure_headers/issues/480

Start in lib/secure_headers/headers/content_security_policy_config.rb at the referenced line and inspect how the current default-src value is assembled. Read issue #480 to understand the proposed breaking-change context. Done means the default is set to none without overriding directives explicitly configured by users.

由索引模型根据 Issue 内容生成。