[e.cash] Enable CSP header

Summary:
T3395

We have this enabled as Report-Only right now. I'm not seeing any Report-Only log notices in browsing the site. So, actually enable it.

Test Plan: Navigate to https://e.cash and confirm you do not see any Content-Security-Police-Report-Only statements

Reviewers: #bitcoin_abc, Fabien

Reviewed By: #bitcoin_abc, Fabien

Differential Revision: https://reviews.bitcoinabc.org/D15228