message: add a content security policy to the website
diff: "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "DENY",
  "X-XSS-Protection": "1; mode=block",
  - "Referrer-Policy": "no-referrer, strict-origin-when-cross-origin"
  + "Referrer-Policy": "no-referrer, strict-origin-when-cross-origin",
  + "Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' www.rust-lang.org; font-src 'self'"
  }
  }
  