fix nginx security headers not being applied to https responses

nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.

docker/nginx/nginx.conf

@@ -13,8 +13,5 @@ http {
     access_log /var/log/nginx/access.log;
     error_log  /var/log/nginx/error.log;
 
-    add_header X-Content-Type-Options nosniff;
-    add_header X-Frame-Options DENY;
-
     include /etc/nginx/conf.d/*.conf;
 }