feat: Create nosecone package for adding secure headers to applications

[blaine-arcjet]

This is my first pass at our nosecone package. This implementation is used as middleware and the headers are set for the response.

This works really well for Next.js because we can force the headers to be forwarded and it even detects the nonce from the script-src directive, which it adds to each <script> tag that webpack generates. This mechanism doesn't work for Remix or SvelteKit and the nonce is hard to access in Express applications—there are ways to get around this that are framework-specific, but everything will be quite finicky.

Notably missing:

• Tests
• SvelteKit support
• Remix support
• Usefulness in Express

My instinct here would be to remove everything except the Next.js middleware support and ship a v0 that we can test in our application and making incremental tweaks.

All that being said, I really don't like the generalized concept here and I think this makes more sense as a series of packages crafted for specific frameworks. For example, SvelteKit would benefit from a split package where the defaults are set in the svelte.config.js file and middleware that sets the various other headers, which would defer nonce usage to the framework. We could have these framework-specific packages exist as part of a different monorepo that is managed independently of our SDK.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.