Set default security headers in Django template

[timmc-edx]

We have an opportunity to start out all new Django services with strict CSP, HSTS, and other good security defaults. These can then be changed as needed as the application grows and changes.

(Strict CSP is very easy to achieve in a brand-new application, and more painful to achieve in an existing application.)