Bugfix/middlewear auth order

[gecBurton]

Context

This PR fixes an error that occurs on email link clicks causing 401 errors that go away on refresh.

The middleware was calling next() before validating and setting the authentication cookie. This meant SSR code in Layout.astro and questions.astro tried to call fetchBackendApi with no auth token available.

Changes proposed in this pull request

1. Validate OIDC token and set auth cookie FIRST
2. Check staff permissions
3. THEN call next() to render the page
4. Add security headers to response

Guidance to review

Link to Trello ticket

Things to check

• I have added any new ENV vars in all deployed environments and updated the .env.test files in the repo