feat(security): make security headers configurable

[ayeshafaeza-2427]

Description

This PR improves the configurability of backend security headers while preserving the existing default behavior.

Changes

• Made X-Content-Type-Options configurable using ENABLE_X_CONTENT_TYPE_OPTIONS.
• Made X-Frame-Options configurable using ENABLE_X_FRAME_OPTIONS.
• Added configurable support for X-Permitted-Cross-Domain-Policies.
• Added configurable support for X-DNS-Prefetch-Control.
• Added documentation for configurable security header settings in the backend README.

Why

The project already includes core security mechanisms such as CSP, HSTS, CORS, and rate limiting. This PR enhances flexibility by allowing additional security headers to be enabled or disabled through configuration without changing the default behavior.

Closes #105

[github-actions]

🎉 Thank you for your first Pull Request to DevLink!

We appreciate your contribution to our open-source community.

Before your PR is reviewed, please ensure:

• ✅ The project builds successfully.
• ✅ Your code follows the project's coding standards.
• ✅ You have tested your changes.
• ✅ Related documentation has been updated if necessary.

Our maintainers will review your PR as soon as possible.

Thank you for helping improve DevLink! 💙

[nensii21]

CI job is failing.

[ayeshafaeza-2427]

Hi! @nensii21 I checked the failing Backend CI job. The formatter (black --check) is reporting formatting issues in files such as backend/app/core/celery_app.py and several notification-related files, which are not part of this PR. The changes in this PR are limited to:

backend/app/core/config.py
backend/app/middleware/security_headers.py
backend/README.md

Could you please confirm whether the CI is picking up formatting issues from the base branch? I'm happy to make any changes needed if there's something specific in my PR.