ResponseHeadersPolicy requires SecurityHeadersConfig

[felipeochoa]

Thanks to AWS support I learned that SecurityHeadersConfig is required in AWS::CloudFront::ResponseHeadersPolicy. The docs currently say otherwise, so it would be great to update accordingly.

Additionally, I learned through trial and error that AccessControlAllowHeaders cannot be an empty list. It would be helpful to note that at least one header needs to be included there