Security: Document implementation of Content-Security-Policy

[jpmckinney]

• Add to JS page and link from HTML/CSS
  • Rationale (cybersecurity insurance) https://platform.securityscorecard.io/#/scorecard/open-contracting.org/issues/OPEN
  • Chrome plugin to prepare heading
  • Common patterns from existing repos
  • Cloudflare configuration for static websites
  • Testing approach (example of missed issue from standard repo) Extensions list is broken on the party details page standard#741 (comment) open-contracting/deploy@b11732c
  • Links to any blockers with frameworks
• Also add subresource integrity instructions (tool linked from MDN, use default SHA384)
• And same for X-Content-Type-Options