Per-shop security edge headers

Added a new security settings group to shops allowing configuration of Content Security Policy (CSP), permissions policies, and HSTS preload headers. These settings are automatically mirrored to the edge cache so Nginx can attach them to responses without hitting the application.