fix nginx security headers not being applied to https responses

nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.

docker/nginx/conf.d/hantim.net.conf

@@ -36,7 +36,7 @@ server {
     ssl_certificate     /etc/letsencrypt/live/hantim.net/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/hantim.net/privkey.pem;
 
-    add_header Strict-Transport-Security "max-age=63072000; preload" always;
+    include /etc/nginx/conf.d/security-headers.inc;
 
     location /media/ {
         proxy_pass http://garage:3902/;