feat(core-shared): add security headers module with CSP builder and nonce util

Adds framework-agnostic security headers module to core-shared/security:
- SecurityHeadersConfig + CspMode types
- generateNonce() using crypto.randomBytes(16)
- buildSecurityHeaders() emitting all six headers (HSTS, X-Frame-Options,
  X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP) with
  prod (strict-dynamic + nonce threading) and dev (unsafe-inline/eval +
  ws/localhost) CSP modes; URL validation throwing InvalidSecurityHeadersConfig
  on malformed allowedConnect/Img/FontOrigins
- Full unit test suite (24 tests, 100% coverage on runtime files)
- Exported from core-shared barrel and ./security subpath

Blocks story 07 (framework adapters) and stories 08-09 (app wiring).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/package.json

@@ -21,7 +21,8 @@
     "./instrumentation/otel": "./src/instrumentation/otel/index.ts",
     "./instrumentation/otel/init-server-node": "./src/instrumentation/otel/init-server-node.ts",
     "./instrumentation/sentry/init-client": "./src/instrumentation/sentry/init-client.ts",
-    "./instrumentation/sentry/init-client-react": "./src/instrumentation/sentry/init-client-react.ts"
+    "./instrumentation/sentry/init-client-react": "./src/instrumentation/sentry/init-client-react.ts",
+    "./security": "./src/security/index.ts"
   },
   "scripts": {
     "build": "tsc --noEmit",