Remove secure_headers gem (LG-6184)

[zachmargolis]

Previous PRs have added replacement functionality for the things we care about from this gem and added regression specs:

• Add config to use Rails for secure headers options (LG-5771) #5952 added X-Frame-Options, X-XSS-Protection, etc
• LG-5772 Move securing cookies out of Secure Headers #5963 made sure all cookies have the secure and httponly attributes
• LG-5770 SecureHeaders: Remove CSP feature flags #5974 switched to using the built-in Rails CSP tooling

I am going to deploy this to my personal environment to make sure it doesn't break using the acuant SDK on mobile

[zachmargolis]

@mitchellhenke @aduth testing in my personal environment, I got some CORS errors... can one of you confirm my understanding that it's probably not related to these changes? Since the headers need to be set on the resource, so on CDN/S3 side instead of the IDP... something else in my environment must be off?

[zachmargolis]

Confirmed that, other than above font issue, this works in a deployed environment with the mobile SDK

[zachmargolis]

1. this is slightly different than the 31536000 is the old test, but I figured it was close enough
2. I create this new test here, since the SSL middleware is not added to tests by default, the old request specs didn't exercise it. I couldn't figure out a nice way to add the SSL middleware for just that test, so I went with this approach of just testing the middleware directly with our app's config

[aduth]

testing in my personal environment, I got some CORS errors... can one of you confirm my understanding that it's probably not related to these changes? Since the headers need to be set on the resource, so on CDN/S3 side instead of the IDP... something else in my environment must be off?

Seems similar to an issue I'd once reported on Slack that couldn't be repro'd by others. FWIW, I couldn't see any CORS errors while navigating your sandbox. But yeah, I would sorta assume it's something configured on the CDN side of things.