Set a Permissions-Policy

[twm]

The Permissions-Policy response header allows lockdown of sensitive web APIs. Setting it would be a good defense-in-depth measure in concert with the current HTML sanitization regime.

[twm]

Note this isn't worth doing until Firefox supports the header.