Add in SecureHeaders, move config over to that

[DarthHater]

I rule and have completed some work on Case Manager that's ready for review!

An alternative to #1096 , adds in Twitter's SecureHeaders and moves config over to that, still a bit of investigation on hash stuff needed.

This pull request makes the following changes:

• Adds in newest SecureHeaders
• Configs it based on preexisting header in code

It relates to the following issue #s:

• Bumps Move CSP from report-only to stop actions #893
• Fixes Install secure_headers gem #412

[codecov-io]

Codecov Report

Merging #1102 into master will decrease coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1102      +/-   ##
==========================================
- Coverage   96.54%   96.53%   -0.01%     
==========================================
  Files          50       50              
  Lines        1041     1038       -3     
==========================================
- Hits         1005     1002       -3     
  Misses         36       36

Impacted Files	Coverage Δ
app/controllers/application_controller.rb	100% <ø> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ca51634...e1f8ede. Read the comment docs.

[colinxfleming]

I like this a lot. After an evening of self clowning I think it might be a good idea to roll with a CSP like this and progressively work on getting inline javascript out of the app as much as possible as a longer term goal. Either way we should merge this because it's definitely a value add -- I'll poke at it tomorrow and push if it passes muster, which I bet it does because our test suite is good $$$$

[colinxfleming]

Thanks for fixing this, I'd been meaning to do it for awhile 💯

[colinxfleming]

I bumped the issue refs -- I think there's a little additional CSP work we want to do at this juncture: a) get any and all inline js out of the app where possible and b) follow that up by adjusting the CSP so it makes things choke rather than reportOnly, so I changed #893 to be a bump rather than a fix. 💯 💯