fix: add CF HTTP security headers

[mavogel]

• see https://github.com/awslabs/aws-solutions-constructs/blob/main/source/patterns/%40aws-solutions-constructs/core/lib/cloudfront-distribution-helper.ts#L58
• see hinode and do a lighthouse check