Set `default-src` CSP Attribute to `none` by default

At GitHub, we set the `default-src` CSP attribute to `none`. This provides the strictest possible CSP as it'll thus only allow CSP directives that the user explicitly has allowlisted.

It would be desirable to set this default in `secure_headers` as well:

https://github.com/github/secure_headers/blob/7f89df2dafb22f1833702eef4a01d4794b2066f0/lib/secure_headers/headers/content_security_policy_config.rb#L133

This would be a breaking change, so if this is desirable, this would fit well in with https://github.com/github/secure_headers/issues/480