Add security response headers

[lbeaufort]

Summary

Resolves #3069

• Adds content security policy response headers to every page. See original issue for background information.
• Add report-uri that sends violation reports to API for now (ran into csrf issues with a Django route)
• Add CSRF_TRUSTED_ORIGINS setting to address csrf errors

Impacted areas of the application

List general components of the application that this PR will affect:

• This will impact everything on our website. Need to make sure that there are no loading errors for anything we pull into our site like api calls, scripts, images, fonts, etc.

Screenshots

None, this is pure code

Related PRs

List related PRs against other branches:

branch	PR
openFEC/feature/3876-add-response-headers	link

How to test

Check each section of the site to make sure that the content security policy is not interfering with anything we're pulling into the site.

• Homepage
• Data landing
• Election search page
• All datatable pages
• Candidate profile pages
• Committee profile pages
• Election profile pages
• Wagtail admin (creating new pages, updating pages, saving pages, adding new block components)
• Wagtail generated pages
• Legal resource pages

How to test the changes on stage

• I pushed a deploy to stage with Circle (as of 8/28) (stage.fec.gov)
• Test API for console errors
• Curl API to check headers
• Run scan like https://securityheaders.com/ and https://csp-evaluator.withgoogle.com/ results
• Make sure CMS can still access what it needs

[codecov-io]

Codecov Report

❗ No coverage uploaded for pull request base (develop@9aee54b). Click here to learn what that means.
The diff coverage is 100%.

@@            Coverage Diff             @@
##             develop    #3124   +/-   ##
==========================================
  Coverage           ?   74.67%           
==========================================
  Files              ?      120           
  Lines              ?     7151           
  Branches           ?      633           
==========================================
  Hits               ?     5340           
  Misses             ?     1811           
  Partials           ?        0

Impacted Files	Coverage Δ
fec/fec/settings/base.py	87.95% <100%> (ø)
fec/fec/middleware.py	100% <100%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9aee54b...2cbee26. Read the comment docs.

[patphongs]

Changes look good! I don't see any further errors for the CSP and the cache-control header is now coming through on the app level domain. This was tested on stage. Thanks for your work on this @lbeaufort!

[fec-jli]

This is great work.
1)on local cms (point to local api) : play with some CSP directives, work as expected.
run curl command, see CSP and cache-control added.
2)on stage, test most pages. work fine.
3) run scan website “stage.fec.gov" and get A score. (before C)