Move CSP and HSTS definitions to settings.py

[aloftus23]

🗣 Description

Move CSP and HSTS definitions to settings.py.

This allows security definitions to be more centralized in one location and follows Django standards.

Also the remediates the Checkmarx medium vulnerability in settings.py. This was a false positive, but it did lead us to the idea that these definitions should be in settings.py.

💭 Motivation and context

Medium Checkmarx vulnerability and cleanup.

🧪 Testing

Passes pre-commit checks and pytests.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced
  in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated
  to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release.

[cduhn17]

Looks good will be nice to have all of this centralized at settings.py