feat: add CSP and other security related headers in the oCIS proxy service (#8777)

* feat: add CSP and other security related headers in the oCIS proxy service

* fix: consolidate security related headers - drop middleware.Secure

* fix: use github.com/DeepDiver1975/secure

* fix: acceptance tests

* feat: support env var replacements in csp.yaml

services/webfinger/pkg/server/http/server.go

@@ -57,7 +57,6 @@ func Server(opts ...Option) (ohttp.Service, error) {
 			cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
 			cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
 		))
-	mux.Use(middleware.Secure)
 
 	mux.Use(middleware.Version(
 		options.Name,