[Chore] Update readme to include Content security policy

[nwittstruck]

You can use a content security policy to restrict which resources are being loaded. The app is completely self contained, so you can use quite strict policies. For nginx, this would look like this:

add_header Content-Security-Policy "default-src 'self' img-src 'self' data:; style-src 'self' 'unsafe-inline'" always;

There are couple of inline styles that will be removed in the future, so that unsafe-inline can be removed as well.