Function security_headers 

pub async fn security_headers(req: Request, next: Next) -> Response

Middleware that injects standard HTTP security headers on every response.

Headers set:

• X-Content-Type-Options: nosniff — prevents MIME-type sniffing
• X-Frame-Options: DENY — blocks clickjacking via iframes
• X-XSS-Protection: 1; mode=block — legacy XSS filter hint
• Strict-Transport-Security: max-age=63072000; includeSubDomains — enforces HTTPS for 2 years
• Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'