[e.cash] Add recommended security headers

Summary:
T3395

Add recommended headers.

Note: CSP header is added as 'report-only' so that we can confirm it does not break the site.

ref
https://nextjs.org/docs/pages/api-reference/next-config-js/headers
https://github.com/vercel/next.js/discussions/17991 for source: key to cover whole site

Test Plan:

docker build -t ecash_local .
docker run -it --rm -p 3000:3000 ecash_local
curl -I http://localhost:3000

Confirm terminal output includes headers

Reviewers: #bitcoin_abc, Fabien

Reviewed By: #bitcoin_abc, Fabien

Differential Revision: https://reviews.bitcoinabc.org/D15222