Implement Envoy Default Security Headers Filter

Implement default security filter envoy filter to set these headers if they don't already exist (list subject to change).

• Strict-Transport-Security: max-age=31536000; includeSubDomains
• X-Frame-Options: SAMEORIGIN
• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin

Verify all apps work without breakage.