Update default policies

[andrewlock]

• Adds a "default secure" permissions policy option, based on the suggestion from OWASP
  • Only includes directives that are supported by the library (i.e. not experimental/unsupported) directives etc
• Updates the default CSP to add default-src: none instead of obj-src:none (the latter falls back to default-src.
• Add an "API" default secure set of headers, based on the suggestion from OWASP for non-HTML endpoints. You can add this by calling AddDefaultApiSecurityHeaders()

For the permissions-policy secure default, you can do

app.UseSecurityHeaders(p => p.AddPermissionsPolicyWithRecommendedDirectives());

This is equivalent to calling

app.UseSecurityHeaders(p => p.AddPermissionsPolicy(builder => 
{
    builder.AddAccelerometer().None();
    builder.AddAmbientLightSensor().None();
    builder.AddAutoplay().None();
    builder.AddCamera().None();
    builder.AddDisplayCapture().None();
    builder.AddEncryptedMedia().None();
    builder.AddFullscreen().None();
    builder.AddGeolocation().None();
    builder.AddGyroscope().None();
    builder.AddMagnetometer().None();
    builder.AddMicrophone().None();
    builder.AddMidi().None();
    builder.AddPayment().None();
    builder.AddPictureInPicture().None();
    builder.AddPublickeyCredentialsGet().None();
    builder.AddScreenWakeLock().None();
    builder.AddSyncXHR().None();
    builder.AddUsb().None();
    builder.AddWebShare().None();
    builder.AddXrSpatialTracking().None();
}));

Related to #133