Harden Headers (#2721)

* Basic security headers

* Remove XSS Header (not relevent)

* Fix config name

* Use Arr::get()

* Add tests

* Re-fix the StoreConfig step for fresh installs

Co-authored-by: luceos <luceos@users.noreply.github.com>
Co-authored-by: Alexander Skvortsov <askvortsov1@users.noreply.github.com>

src/Admin/AdminServiceProvider.php

@@ -59,7 +59,9 @@ class AdminServiceProvider extends AbstractServiceProvider
                 HttpMiddleware\SetLocale::class,
                 'flarum.admin.route_resolver',
                 HttpMiddleware\CheckCsrfToken::class,
-                Middleware\RequireAdministrateAbility::class
+                Middleware\RequireAdministrateAbility::class,
+                HttpMiddleware\ReferrerPolicyHeader::class,
+                HttpMiddleware\ContentTypeOptionsHeader::class
             ];
         });