Check security HTTP headers

[jochenklar]

We should check if Content-Security-Policy, Strict-Transport-Security, X-Permitted-Cross-Domain-Policies, Feature-Policy, Permissions-Policy, and Cache-Control can or should be used with RDMO and update the documentation accordingly.