fix(security): add headers, harden cookies, fix redirect

[capy-ai]

This PR adds essential HTTP security headers to all responses, hardens the referer redirect logic to prevent open redirects, and updates SameSite cookie handling to always use Lax instead of None when HTTPS is enabled.

Changes

• nitter.nim: Adds setSecurityHeaders template in before hook to inject X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, X-XSS-Protection: 0, Permissions-Policy: interest-cohort=(), and a strict CSP; sets HSTS when cfg.useHttps is true.
• router_utils.nim: Validates referer query parameter to ensure it is a relative path (starts with /, no // or /\) before redirecting; forces SameSite.Lax for preference cookies regardless of HTTPS status.