add security headers

[travi]

https://securityheaders.io/?q=admin.travi.org&followRedirects=on

• Strict-Transport-Security
• Content-Security-Policy
  • -Report-Only
  • activate
  • support webpack dev server locally
  • require-sri-for script style
• Public-Key-Pins
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Referrer-Policy
• Expect-CT

[travi]

https://github.com/nlf/blankie

[travi]

subresource-integrity

• https://www.npmjs.com/package/webpack-subresource-integrity
• https://github.com/nlf/blankie#options
• https://scotthelme.co.uk/enforcing-the-use-of-sri/