[Website] Enable Content Security Policy

Major reasons to implement:

1. It heavily locks down ways for any script to contact the outside world from the context of the page, making it extremely difficult for people to exfiltrate data.
2. The only downsides are when you have analytics scripts and tag managers running, as CSP shuts them down easily... but keybase doesn't have any analytics on it from what I can tell.

Some info I gathered:

default-src 'self' https://keybase.io https://s3.amazonaws.com; object-src 'none'; report-uri https://somereporturi/some/path should be sufficient tbh and would be a good jumping off point.

The only problems I can see is sometimes inline JS is injected... like the window.csrf_token = "xxx" script tag... this could be taken care of with a nonce directive... or you could tweak your site to not need inline JS.

Most CSP policies are rolled out as follows:

1. Make an educated guess at a policy, and implement as report-only via Content-Security-Policy-Report-Only header.
2. Set the report-uri directive to point to an endpoint you control. (I recommend https://report-uri.com/ free account should be fine.)
3. Monitor for a few days or weeks or whatever.
4. If you notice a large number of users hitting the same violation over and over, consider either adding a directive to open a hole for it, or fix the site to remove the access.
5. Fix the policy.
6. Switch to Content-Security-Policy and actually enforce.

No files, tests, or entry points are named. Start by locating the website response-header configuration and reviewing the proposed Content-Security-Policy-Report-Only policy, including the inline CSRF script and report endpoint. Done means monitoring violations, resolving required exceptions, and switching to an enforced Content-Security-Policy header.