extra http headers, ie: content security policy

[totaam]

Add the ability to provide extra http headers through a configuration file, so we can more easily add support for things like CSP.
Users can then also add their own headers without needing to modify the code.

[totaam]

Done in r18000.
We ship a directory called http-headers, all files found in this directory are parsed and added to the http headers.
The old "nocache" headers are now handled this way, and there is a basic CSP file too.

[totaam]

See also HSTS: #1664