Add Content-Security-Policy

It seems weather.torproject.org is missing a Content-Security-Policy. I think it (like pretty much any web service) would benefit from a well configured CSP.