fix(gateway-worker): serve GraphiQL under a strict CSP, and send nosniff and no referrer everywhere

[Hebilicious]

Closes #15

What changed

• The page module. New apps/gateway/src/graphiql-page.ts renders Yoga's GraphiQL page. RenderedPages renders it once per isolate and again after a failed render. The page keeps Agris's icon.
• The policy. The page is served with a Content-Security-Policy, built by graphiqlContentSecurityPolicy:
  • it allows only the page's inline scripts, each by its hash whatever its tag's attributes, plus the pinned @graphql-yoga/graphiql release's dist/ directory;
  • it lets the page connect only to the gateway and that release;
  • default-src, base-uri, object-src, form-action and frame-ancestors are 'none';
  • the page is also sent with X-Frame-Options: DENY.
• Every public response carries X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer, unless the response states its own (SECURITY_HEADERS in public-gateway.ts). The 429 response no longer sets nosniff itself.
• Docs. GraphiQL stays on by default. docs/deploy.md explains the policy and when to set GRAPHIQL=disabled. The gateway README names the module.
• Tests. public-gateway gains a policy step in public-gateway-graphiql and new scenarios public-gateway-graphiql-inline-scripts, public-gateway-graphiql-render-retry and public-gateway-security-headers.

How it was reproduced

I ran this layer's public-gateway feature against the parent's gateway (audit/self-hosted-default-limit), with the bundle built at the parent. I overlaid apps/gateway/src/graphiql-page.ts, the new module two scenarios test directly; the parent's gateway never imports it.

Scenario	On the parent
public-gateway-graphiql	fails: AssertionError: The response has no Content-Security-Policy
public-gateway-security-headers	fails: Referrer-Policy is null, not 'no-referrer'
public-gateway-graphiql-inline-scripts	passes
public-gateway-graphiql-render-retry	passes
the 15 others	pass

Not reproduced

• public-gateway-graphiql-inline-scripts and public-gateway-graphiql-render-retry are unit tests of the new module, which was overlaid. They pass on the parent and say nothing about it.
• A compromise of unpkg or of the npm artifact. The policy still trusts unpkg to serve the pinned release unchanged, as docs/deploy.md says.

Refs #21 (security audit tracking issue). Part of stack #42; review bottom-up, each layer shows only its own diff.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1acd6f3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR