Add Content Security Policy (CSP) Headers to OAuth Authentication Flow

[aws-security-agent]

Summary

This PR adds Content Security Policy (CSP) headers and additional security headers to all HTTP responses in the OAuth authentication flow to strengthen defense-in-depth protections against XSS attacks.

Changes Made

• Added add_security_headers() helper function that sets:
  • Content-Security-Policy: Restrictive policy allowing only inline scripts/styles needed for OAuth pages
  • X-Content-Type-Options: nosniff (prevents MIME type sniffing)
  • X-Frame-Options: DENY (prevents clickjacking)
  • X-XSS-Protection: 1; mode=block (legacy XSS protection)
• Updated all 6 HTTP response locations in OAuthCallbackHandler and AuthChoiceHandler to use the new security headers function

Security Benefits

• CSP: Provides additional layer of XSS protection by restricting script execution sources
• Defense-in-depth: Multiple security headers work together to mitigate various attack vectors
• Clickjacking protection: X-Frame-Options prevents embedding in iframes
• MIME sniffing protection: X-Content-Type-Options prevents browser from interpreting files as different MIME type

Scope

• Local OAuth callback server only (localhost:8080)
• No impact on application functionality
• No breaking changes
• Headers are informational/protective only

[aws-security-agent]

AWS Security Agent is reviewing your pull request and will post feedback shortly.

[aws-security-agent]

No issues identified.