Add strict CSP / maybe other isolation headers

[domenic]

Unlike most WHATWG sites which are static, public resources, this site could actually benefit.

https://csp.withgoogle.com/docs/strict-csp.html