vault: tighten public response headers

services/vault/middleware.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: vault
 spec:
   headers:
+    contentSecurityPolicy: "default-src 'none'; connect-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'unsafe-inline' 'self'; form-action 'none'; frame-ancestors 'none'; font-src 'self'"
     contentTypeNosniff: true
     frameDeny: true
     referrerPolicy: no-referrer
@@ -26,6 +27,8 @@ spec:
       Server: ""
       X-Powered-By: ""
       X-Vault-Cluster: ""
+      X-Vault-Index: ""
+      X-Vault-Known-Leader: ""
       X-Vault-Namespace: ""
 
 ---