[Hint] Content-Security-Policy HTTP header

[molant]

Originally reported by @alrra in webhintio/hint#25

---

• Check if the header is sent for non-HTML resources (e.g.: on images, fonts, etc.) - done in webhintio/hint@c55bdfb.
• Check for older deprecated version of the header are sent (i.e.:X-WebKit-CSP, X-Content-Security-Policy).

---

• TODO: Look into what other checks we can add for that this (e.g.: validate the content of the header, upgrade-insecure-requests)

---

See also:

• https://content-security-policy.com/