Send Content Security Policy (CSP) Header
Hi,
to avoid any accidental connection to twitter, i would suggest that nitter should send a strong CSP Header itself.

I use the following in my reverse proxy without breaking functionality in FireFox 86 and Chromium 89.

These are Preferences i've set in my `nitter.conf`:
```
proxyVideos = true
hlsPlayback = true
infiniteScroll = true
```

Content-Security-Policy:
```
default-src 'none';
img-src 'self';
style-src 'self' 'unsafe-inline';
script-src 'self' 'unsafe-inline' blob:;
font-src 'self';
media-src 'self' blob:;
base-uri 'none';
frame-ancestors 'none';
form-action 'self';
connect-src 'self';
upgrade-insecure-requests;
```

The `blob:` <scheme-source> are necessary for `hlsPlayback = true`.
`connect-src 'self';` was necessary for `infiniteScroll = true`.