Security: Document implementation of Content-Security-Policy

[jpmckinney]

Add to JS page and link from HTML/CSS

• Rationale (cybersecurity insurance) https://platform.securityscorecard.io/#/scorecard/open-contracting.org/issues/OPEN
• Chrome plugin to prepare heading
• Common patterns from existing repos
• Cloudflare configuration for static websites
• Testing approach (example of missed issue from standard repo) Extensions list is broken on the party details page standard#741 (comment) open-contracting/deploy@b11732c
• Links to any blockers with frameworks

Also add subresource integrity instructions (tool linked from MDN, use default SHA384)

And same for X-Content-Type-Options