chore: remove duplicate security headers

[rivanuff]

Deze headers worden voor vrijwel alle brave sites al gezet in:

• https://github.com/yardinternet/wp-nginx-snippets/blob/main/includes/clickjacking.conf
• https://github.com/yardinternet/wp-nginx-snippets/blob/main/includes/hsts.conf

[Copilot]

Pull request overview

This PR removes several HTTP security headers from the PHP send_headers hook because they are already being set at the Nginx layer for (most) Brave sites, reducing the chance of duplicate response headers. It also corrects a method name typo related to the CSP header sender.

Changes:

• Stop sending Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options from src/Security.php.
• Keep Referrer-Policy and Permissions-Policy headers being sent from PHP.
• Rename sendScpHeader() to sendCspHeader() for clarity/consistency.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.