Set secure HTTP headers

Add all six recommended security response headers to a [Language/Framework] web application as a single middleware or filter that applies to every response. The headers to add are: Content-Security-Policy, Strict-Transport-Security with includeSubDomains and preload, X-Frame-Options set to DENY, X-Content-Type-Options set to nosniff, Referrer-Policy, and Permissions-Policy. For each header explain what class of attack it mitigates and show the middleware code.