Add various HTTP headers to improve security

[Andrew-Dickinson]

Improve our security by following the HTTP header recommendations from the following resources:

• https://realpython.com/django-nginx-gunicorn/#incorporating-nginx
• https://securityheaders.com/?q=db.nycmesh.net%2Fadmin&followRedirects=on

Setting X-Forwarded-Proto also fixes a bug which caused a mixed content error on the changes from #636, since it fixes the value Django uses for request.scheme (currently set to http in prod due to the reverse proxy)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.18%. Comparing base (28649c1) to head (c08c817).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #643   +/-   ##
=======================================
  Coverage   94.18%   94.18%           
=======================================
  Files          80       80           
  Lines        3251     3251           
=======================================
  Hits         3062     3062           
  Misses        189      189           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Andrew-Dickinson]

Is this naughty? We give it out for free to anyone who hits the site so having it in code seems fine?

[james-otten]

Verify correct type and limited access

[Andrew-Dickinson]

This is definitely a client token, from the docs we are definitely using it correctly:

For security reasons, API keys cannot be used to send data from a browser, mobile, or TV app, as they would be exposed client-side. Instead, end user facing applications use client tokens to send data to Datadog.

I can't find any knobs to turn for the permissions on the token, and nothing is mentioned in the docs about this. I think client tokens are inherently limited to only specific things (probably to prevent footguns)

[james-otten]

Great stuff. Thank you for doing this!