Scan HTTP Security Headers in Python and Fail CI When HSTS or CSP Is Missing

A stdlib CLI that checks HSTS, CSP, and X-Content-Type-Options, treats frame protection and Referrer-Policy as recommended, and exits 1 so GitHub Actions can block a bad deploy