HTTP security headers

[coliff]

We can improve the security headers score: https://securityheaders.com/?q=oktech.jp&followRedirects=on

I always set this in the netlify.toml config.

[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = "upgrade-insecure-requests"
    Permissions-Policy = "camera=(), microphone=(), midi=()"
    Referrer-Policy = "no-referrer-when-downgrade"
    X-Content-Type-Options = "nosniff"
    X-Frame-Options = "SAMEORIGIN"
    X-XSS-Protection = "0"

and then you get A rating :-)

[coliff]

UPDATE: We can't do this on GitHub Pages but we can if we move it to Cloudflare Pages.

[kurisu-dotto-komu]

If we move to Cloudflare, this will require a big update to our workflows.

We can do this, but the original requirement was to use github pages.

I haven't tried to implement the kind of caching we'd need using Cloudflare, which is currently taking at least around 10 minutes per build (unacceptable).

Netlify is solid for this kind of thing, and is building in less than a minute with zero config.

If we are going to use a third party, let's decide together which one is best. cc @martinheidegger

[coliff]

GitHub Pages is totally fine with me. We don't need to move if it's a hassle.

Or, we could use Netlify for production only (not for deplpy previews - so we don't run into the limitations) and maybe Cloudflare just for the PR deploy previews....

[martinheidegger]

Cloudflare would be good for the preview as we have currently only a modicum of updates to the website per month and if we have more they will be more as well.

[martinheidegger]

It would be nice to have help with #143 - I don't know why the build refuses.