feat(core-shared): add TanStack Start security header adapter

Exports withSecurityHeaders() and getNonce() from the
./security/tanstack subpath. withSecurityHeaders() returns all six
security headers plus x-nonce for use inside a TanStack/Nitro H3
server middleware; getNonce() reads x-nonce from the node request
headers forwarded by that middleware.

Mirrors the ./security/next adapter pattern while staying free of
any @tanstack/start dependency — the adapter works with plain H3
IncomingMessage types that TanStack Start exposes at wiring time
(Story 09).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,18 +1,18 @@
 {
-  "generatedAt": "2026-05-20T09:45:48.959Z",
-  "commit": "6575a48",
+  "generatedAt": "2026-05-20T09:55:49.120Z",
+  "commit": "6903c59",
   "repo": {
     "statements": 97.43,
-    "branches": 92.51,
-    "functions": 97.27,
+    "branches": 92.56,
+    "functions": 97.28,
     "lines": 97.43,
     "counts": {
-      "lf": 6063,
-      "lh": 5907,
-      "brf": 1215,
-      "brh": 1124,
-      "fnf": 366,
-      "fnh": 356
+      "lf": 6079,
+      "lh": 5923,
+      "brf": 1223,
+      "brh": 1132,
+      "fnf": 368,
+      "fnh": 358
     }
   },
   "byPackage": {
@@ -101,17 +101,17 @@
       }
     },
     "@repo/core-shared": {
-      "statements": 98.37,
-      "branches": 96.39,
-      "functions": 93.39,
-      "lines": 98.37,
+      "statements": 98.39,
+      "branches": 96.47,
+      "functions": 93.5,
+      "lines": 98.39,
       "counts": {
-        "lf": 1288,
-        "lh": 1267,
-        "brf": 360,
-        "brh": 347,
-        "fnf": 121,
-        "fnh": 113
+        "lf": 1304,
+        "lh": 1283,
+        "brf": 368,
+        "brh": 355,
+        "fnf": 123,
+        "fnh": 115
       }
     },
     "@repo/core-ui": {