fix(security): increase CSP policy by explicitly sandboxing uploads

Adding the sandbox attribute tells browsers to apply stricter
restrictions like preventing execution of plugins and scripts.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

app.js

@@ -159,7 +159,7 @@ app.use(i18n.init)
 // security headers for uploads
 app.use('/uploads', (req, res, next) => {
   res.set('Content-Disposition', 'attachment')
-  res.set('Content-Security-Policy', "default-src 'none'")
+  res.set('Content-Security-Policy', "default-src 'none'; sandbox")
   next()
 })