Generate CSP headers for static/pre-generated routes

[tlaundal]

SvelteKit has good support for Content Security Policy, and will automatically generate both <meta> tags and headers.

It seems that currently the adapter serves CSP headers for requests that hit the /api/__render function, but pre-generated or static routes do not get a header. SvelteKit does add the <meta> tag with CSP for pre-generated routes, so this issue is perhaps not so severe.

It would be nice if the adapter would add the headers to global headers, so they apply also for serving static pages. There are also options for headers per route, which may be more applicable for this use.