Response headers (CSP, HSTS, …) are dropped when a page is prerendered #2

Thanks for the bundle, prerendering from routes rather than content is a great fit for Symfony apps.

What happens

PageRenderer::render() keeps the response body and its format, and RenderedPage only carries content and format. Every other header the application sets on the response is discarded during generation: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, whether they come from NelmioSecurityBundle or from a kernel.response listener.

So an app that ships a strict policy when served by PHP loses it silently once exported: the "no runtime to exploit" gain comes with losing the defence-in-depth headers. GitHub Pages cannot set custom headers at all, but Cloudflare Pages, Netlify, Caddy and nginx can, and the bundle already knows what they should be.

Proposal (opt-in, backward compatible)

1. RenderedPage gains an optional array $headers = [], filled by PageRenderer from an allowlist: Content-Security-Policy (and -Report-Only), Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the three Cross-Origin-* policies. Never Set-Cookie, Cache-Control or Vary, which describe the dynamic response rather than the page.
2. A headers_file option (default null, e.g. '_headers') writes them at the end of a run, in the format Cloudflare Pages and Netlify read:

   /blog
     Content-Security-Policy: default-src 'self'; …
     Strict-Transport-Security: max-age=31536000; includeSubDomains
   

3. Docs: add the headers to the Caddy and nginx examples, and note that GitHub Pages cannot set headers at all. A <meta http-equiv="Content-Security-Policy"> fallback exists, but browsers ignore frame-ancestors, report-uri and sandbox there, and HSTS cannot be set that way.

I'm happy to open a PR along these lines, with tests, if the direction suits you. Two questions first: should the allowlist be configurable, and would you rather keep the headers-file writer as an event listener in the docs than as a bundle option?