Add Content-Security-Policy headers

[TameTheGame]

Description

Adds the three Content Security Policy directives proposed in #385 to every response from both Gokapi HTTP servers:

frame-ancestors 'none'; object-src 'none'; base-uri 'self'

The main application gives only /serviceworker/index.html a narrowly scoped frame-ancestors 'self' exception because the HTTPS client-side encrypted-download flow loads that StreamSaver document in a hidden same-origin iframe. Inline-served uploaded files retain their existing sandbox policy as an additional, cumulative CSP policy.

Closes #385.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor / Chore

Technical Details

• Database changes: No
• Storage backend affected: No
• Usage of AI: Yes. OpenAI Codex performed the repository analysis, implementation, test creation/execution, and an independent security-focused review at the contributor's direction. AI assistance was also disclosed before implementation in the issue thread.

How Has This Been Tested?

• Manual Testing: No browser-level manual test; the behavior is exercised through live HTTP server tests.
• Unit Tests: The focused middleware, main-server, setup-server, and affected-package suites pass under both test,awsmock and test,noaws build tags.
• Environment: Windows, Go 1.25.14. go generate ./..., go fmt ./..., and git diff --check also pass.

The complete Windows go test ./... run was attempted. It reaches unrelated pre-existing Windows-specific failures involving path separators, locked SQLite/test files, certificate-day rounding, and an address-binding test; the address-binding failure reproduces unchanged on the exact base commit. The pull request's Linux CI matrix is the authoritative full-suite result.

Checklist

• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation. (No user-facing configuration or workflow changed.)
• My changes generate no new warnings.