Refactor http_security_headers()

Using an array to define Content Security Policy makes it easier to
maintain it. Adding a new CSP then becomes as simple as adding an
element to the array, as opposed to editing the string sent to header().