add csp headers for netlify

netlify.toml

···
   for = "/.well-known/*"
   [headers.values]
     Access-Control-Allow-Origin = "*"
+
+    [[headers]]
+      for = "/*"
+      [headers.values]
+        Content-Security-Policy = """
+          default-src 'self';
+          script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com;
+          style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+          font-src 'self' https://fonts.gstatic.com;
+          img-src 'self' data: https:;
+          connect-src 'self' https://bsky.social https://*.bsky.network;
+          frame-ancestors 'none';
+          base-uri 'self';
+          form-action 'self';
+        """
+        X-Frame-Options = "DENY"
+        X-Content-Type-Options = "nosniff"
+        Referrer-Policy = "strict-origin-when-cross-origin"