Security headers on GOV.UK

[Nooshu]

GOV.UK already has an excellent security score (A+), as I can see, this tool has been used in the past, all the way back to 2016 😍

I just wanted to raise that there are a couple of minor improvements it lists:

1. Deny by default, using default-src 'none' on the CSP (note: this is the fallback for other media related rules e.g. img-src,font-src etc).
2. Restricts where contents may be submitted by using form-action 'none', form-action 'self', or specific URIs in the CSP.
3. X-Content-Type-Options should be set to nosniff.
4. Referrer Policy should be strict-origin-when-cross-origin
5. Ignore the Subresource Integrity suggestion, it will break HTTP/2 and HTTP/3.

You are welcome to move this into the correct repository or wherever it is more likely to be actioned.