Add failing tests for security headers middleware

Tests for X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
X-XSS-Protection headers on responses.

internal/middleware/middleware.go

@@ -133,3 +133,13 @@ func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 		},
 	)
 }
+
+// SecurityHeaders returns a middleware that adds security headers to responses.
+func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// TODO: implement security headers
+			next.ServeHTTP(w, r)
+		})
+	}
+}