Add convenience functions for secure headers like Content-Security-Policy

[royalicing]

Could be something that accepts a generator function to help make a gnarly header like:
Content-Security-Policy: default-src 'self'; img-src *; media-src *; style-src 'self' 'unsafe-hashes' 'unsafe-inline' https://unpkg.com; script-src 'self'

function* ContentSecurityPolicy() {
  yield src.default('self');
  yield src.img(src.unsafeAny);
  yield src.media(src.unsafeAny);
  yield src.style('self', 'unsafe-hashes', 'unsafe-inline', new URL('https://unpkg.com'));
  yield src.script('self');
}