gateway: introduce a Content Security Policy

### Description and goal

Introduce a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) and send it via an HTTP response header field.

This would mitigate issues such as https://github.com/OpenRailAssociation/netzgrafik-editor-frontend/pull/702.

### Acceptance criteria

.