Security header setup for the Website service (#8)

This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response.

To provide further details about the work:

* Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response:
  * _Content-Security-Policy_,
  * _X-Content-Type-Options_,
  * _X-Frame-Options_,
  * _Referrer-Policy_,
  * _Permissions-Policy_,
  * _Strict-Transport-Security_ (optional).
* Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults.
* The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS.
* Added security-header constants keys and values.

Reviewed-on: rock-n-code/loud-amsterdam#8
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>

Services/Website/Sources/Library/Public/Extensions/AbsoluteConfigKey+Constants.swift

@@ -34,4 +34,19 @@ extension AbsoluteConfigKey {
         /// The absolute configuration key for the directory the static files are served from.
         public static let staticFiles: AbsoluteConfigKey = .init(.Path.staticFiles)
     }
+    /// A namespace for the security headers configuration keys, as absolute keys.
+    public enum Security {
+        /// The absolute configuration key for the `Content-Security-Policy` header value.
+        public static let contentSecurityPolicy: AbsoluteConfigKey = .init(.Security.contentSecurityPolicy)
+        /// The absolute configuration key for the `X-Content-Type-Options` header value.
+        public static let contentTypeOptions: AbsoluteConfigKey = .init(.Security.contentTypeOptions)
+        /// The absolute configuration key for the `X-Frame-Options` header value.
+        public static let frameOptions: AbsoluteConfigKey = .init(.Security.frameOptions)
+        /// The absolute configuration key for the `Referrer-Policy` header value.
+        public static let referrerPolicy: AbsoluteConfigKey = .init(.Security.referrerPolicy)
+        /// The absolute configuration key for the `Permissions-Policy` header value.
+        public static let permissionsPolicy: AbsoluteConfigKey = .init(.Security.permissionsPolicy)
+        /// The absolute configuration key for the `Strict-Transport-Security` header value.
+        public static let strictTransportSecurity: AbsoluteConfigKey = .init(.Security.strictTransportSecurity)
+    }
 }

Services/Website/Sources/Library/Public/Extensions/ConfigKey+Constants.swift

@@ -34,4 +34,19 @@ extension ConfigKey {
         /// The configuration key for the directory the static files are served from.
         public static let staticFiles: ConfigKey = "path.staticFiles"
     }
+    /// A namespace for the security headers configuration keys.
+    public enum Security {
+        /// The configuration key for the `Content-Security-Policy` header value.
+        public static let contentSecurityPolicy: ConfigKey = "security.contentSecurityPolicy"
+        /// The configuration key for the `X-Content-Type-Options` header value.
+        public static let contentTypeOptions: ConfigKey = "security.contentTypeOptions"
+        /// The configuration key for the `X-Frame-Options` header value.
+        public static let frameOptions: ConfigKey = "security.frameOptions"
+        /// The configuration key for the `Referrer-Policy` header value.
+        public static let referrerPolicy: ConfigKey = "security.referrerPolicy"
+        /// The configuration key for the `Permissions-Policy` header value.
+        public static let permissionsPolicy: ConfigKey = "security.permissionsPolicy"
+        /// The configuration key for the `Strict-Transport-Security` header value (omitted when unset).
+        public static let strictTransportSecurity: ConfigKey = "security.strictTransportSecurity"
+    }
 }

Services/Website/Sources/Library/Public/Extensions/String+Constants.swift

@@ -4,6 +4,26 @@ extension String {
         /// The directory, relative to the working directory, that the website's static files are served from.
         public static let staticResources = "Resources/Static"
     }
+    /// A namespace for the security headers' default configuration values.
+    ///
+    /// `Strict-Transport-Security` is intentionally absent: it is only safe over HTTPS and is
+    /// "sticky" in browsers, so it stays off unless explicitly configured in production.
+    public enum Security {
+        /// The default `Content-Security-Policy`.
+        ///
+        /// Restricts every resource to the site's own origin. `style-src` additionally allows
+        /// `'unsafe-inline'` because ``ErrorPage`` ships an inline `<style>` block; remove it once
+        /// the error page's styles move to an external stylesheet.
+        public static let contentSecurityPolicy = "default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+        /// The default `X-Content-Type-Options` (disables MIME sniffing).
+        public static let contentTypeOptions = "nosniff"
+        /// The default `X-Frame-Options` (forbids framing the page).
+        public static let frameOptions = "DENY"
+        /// The default `Referrer-Policy`.
+        public static let referrerPolicy = "strict-origin-when-cross-origin"
+        /// The default `Permissions-Policy` (denies access to powerful browser features the site does not use).
+        public static let permissionsPolicy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
+    }
     /// A namespace for the server string constants.
     public enum Server {
         /// The website server's name.