security: add Content-Security-Policy and security hardening headers

[viccoder-oops]

Summary

• Adds a Content-Security-Policy header restricting scripts, styles, images, fonts, and network connections to trusted origins only
• Adds X-Frame-Options: DENY to prevent clickjacking
• Adds X-Content-Type-Options: nosniff to prevent MIME sniffing attacks
• Adds Referrer-Policy and Permissions-Policy headers for defence in depth
• CSP connect-src explicitly allows Stellar testnet and mainnet RPC/Horizon endpoints so the dashboard keeps working

Changes

• next.config.js: added a headers() async function that applies the security header set to all routes via the /(.*) pattern

Closes #11