[Website] Set security-focused page headers

- Sets X-Frame-Options to SAMEORIGIN
- Sets Strict-Transport-Security to:
  max-age=31536000; includeSubDomains; preload

website/config.rb

@@ -112,3 +112,4 @@ end
 
 # Netlify redirects/headers
 proxy '_redirects', 'netlify-redirects', ignore: true
+proxy '_headers', 'netlify-headers', ignore: true

website/source/netlify-headers

@@ -0,0 +1,3 @@
+/*
+  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+  X-Frame-Options: SAMEORIGIN