Function applySecurityHeaders

Apply OWASP-baseline security headers to a response. Idempotent — if headers are already set, they're left alone.