add csp and content-type headers

csp is pretty basic for now, will beef it up later

studio/next.config.js

@@ -131,6 +131,19 @@ const nextConfig = {
             key: 'X-Frame-Options',
             value: 'DENY',
           },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'no-sniff',
+          },
+          {
+            key: 'Content-Security-Policy',
+            value: `
+            frame-ancestors 'none';
+            upgrade-insecure-requests;
+            `
+              .replace(/\s{2,}/g, ' ')
+              .trim(),
+          },
           {
             key: 'Referrer-Policy',
             value: 'strict-origin-when-cross-origin',