Security: Add configurable CSP headers

[micbar]

Is your feature request related to a problem? Please describe.

CSP (Content Security Policy) headers are improving the security of the application.

We need to make them configurable.

Resources https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Describe the solution you'd like

Add configuration for a configurable CSP

Describe alternatives you've considered

Reverse proxies can add headers, but that is often too generic.

[micbar]

Started in cs3org/reva#4471

Cannot go into 5.0.0 because of code freeze.

[micbar]

fixed by #8761