lib/httpserver: add flags to specify HSTS / Frame-Options / CSP headers for httpserver (#5111)

support `Strict-Transport-Security`, `Content-Security-Policy` and `X-Frame-Options`
HTTP headers in all VictoriaMetrics components. 
The values for headers can be specified by users via the following flags: 
`-http.header.hsts`, `-http.header.csp` and `-http.header.frameOptions`.

Co-authored-by: hagen1778 <roman@victoriametrics.com>

lib/httpserver/httpserver_test.go

@@ -3,6 +3,7 @@ package httpserver
 import (
 	"encoding/json"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 )
 
@@ -34,3 +35,32 @@ func TestGetQuotedRemoteAddr(t *testing.T) {
 	f("1.2.3.4", "foo.bar", `"1.2.3.4, X-Forwarded-For: foo.bar"`)
 	f("1.2\n\"3.4", "foo\nb\"ar", `"1.2\n\"3.4, X-Forwarded-For: foo\nb\"ar"`)
 }
+
+func TestHandlerWrapper(t *testing.T) {
+	*headerHSTS = "foo"
+	*headerFrameOptions = "bar"
+	*headerCSP = "baz"
+	defer func() {
+		*headerHSTS = ""
+		*headerFrameOptions = ""
+		*headerCSP = ""
+	}()
+
+	req, _ := http.NewRequest("GET", "/health", nil)
+
+	srv := &server{s: &http.Server{}}
+	w := &httptest.ResponseRecorder{}
+	handlerWrapper(srv, w, req, func(_ http.ResponseWriter, _ *http.Request) bool {
+		return true
+	})
+
+	if w.Header().Get("Strict-Transport-Security") != "foo" {
+		t.Errorf("HSTS header not set")
+	}
+	if w.Header().Get("X-Frame-Options") != "bar" {
+		t.Errorf("X-Frame-Options header not set")
+	}
+	if w.Header().Get("Content-Security-Policy") != "baz" {
+		t.Errorf("CSP header not set")
+	}
+}