Add security related headers for static resources

[yhwang]

Description

Add the following security headers to static resources, including html, js, and css files.

• Add X-Content-Type-Options header and assign the value to 'nosniff'
• Add Content-Security-Policy header and proper values
  • default-src: 'self'
  • style-src: 'self' 'unsafe-inline' https://fonts.googleapis.com
  • font-src: self fonts.gstatic.com
  • frame-ancestors: self

Motivation and Context

fix: #24271

Impact

N/A

Test Plan

Check the response headers for the static resources

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==
Add security-related headers to the static resources serving from the Presto UI, including: ``Content-Security-Policy``,
``X-Content-Type-Options``.
And here are reference docs about these headers `Content-Security-Policy <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP>`,
`X-Content-Type-Options <https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)>`

[yhwang]

I also added the html5shiv and respond JavaScript files to vendors. Now, they are serving locally, which avoids the cross-domain JavaScript source.

[yhwang]

highlight the two new headers:

[ScrapCodes]

Hi @yhwang , thanks for the work. Just wondering why did we vendor these, instead of getting from CDN?

[yhwang]

good question and the answer is Cross-Domain JavaScript Source File Inclusion.
We already include most of the 3rd party libs except these two. So I directly included them as well. Besides, the script-src attribute of the CSP header has self as the value. I don't want to add oss.maxcdn.com just for these two libs.

[ScrapCodes]

Thanks for clarifying, it seems you are trying to follow the standard here. May be some one more expert can comment on the right path here.