* Include some missing security headers
This change adds the following security headers:
* X-Content-Type-Options to prevent content type sniffing
* Referrer-Policy to prevent leaking referrer information when navigating away from the instance
* Migrate from Docker sample to manual configuration
Migrate the additional security headers from the Docker configuration sample to the manual configuration guide.
