Nginx 低风险漏洞更新

    # 检测到目标 X-Content-Type-Options响应头缺失 这个暂时不开启，不然部分banner无法使用
    #add_header X-Content-Type-Options "nosniff";
    # 检测到目标 X-XSS-Protection响应头缺失
    add_header X-XSS-Protection "1; mode=block";
    # 检测到目标 Content-Security-Policy响应头缺失
    add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
    # 检测到目标 Referrer-Policy响应头缺失
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    # 检测到目标 X-Permitted-Cross-Domain-Policies响应头缺失
    add_header X-Permitted-Cross-Domain-Policies none;
    # 检测到目标 X-Download-Options响应头缺失
    add_header X-Download-Options noopen;
    # 检测到目标 Strict-Transport-Security响应头缺失
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";