Use Content-Security-Policy header

[fisx]

• https://de.wikipedia.org/wiki/Content_Security_Policy
• https://content-security-policy.com/

thanks @tarleb!

[fisx]

this is a non-trivial change. in particular, we need to move all DOM event handlers from HTML attributes to js files and register them in code.

i think it's worth doing, though.