Create Content-Security-Policy headers

[phax]

For the default SMP.
Add a configuration option to disable the CSP setting to restore the old behaviour.
Add a status item to indicate, if CSP header is emitted or not.

[phax]

Part of 5.2.6 release. New webapp.properties are:

• csp.enabled (since 5.2.6): enable or disable the output of the "Content Security Policy" HTTP headers. By default this is enabled.
• csp.reporting.only (since 5.2.6): enable or disable the reporting of CSP issues only. So no content will be blocked if CSP is enabled but a CSP violation is found. By default this is disabled. The reporting URI inside the SMP is always /smp-cspreporting.
• csp.reporting.enabled (since 5.2.6): enable or disable the reporting of CSP issues if something is blocked. This only has an effect, if csp.enabled is true and csp.reporting.only is false. By default this is disabled. The reporting URI inside the SMP is always /smp-cspreporting.