New API Implementation

[oreoshake]

Followup to #181. As with the last PR, it's probably better to ignore the diff and look at the code directly.

The biggest change in this PR is the added support for "named overrides" - additional configuration objects that can be referenced by name. The header values are all precomputed so named overrides save the overhead of building a policy per request.

(from the readme

classApplicationController < ActionController::BaseSecureHeaders::Configuration.defaultdo |config|
config.csp={default_src: %w('self'),script_src: %w(example.org)}end# override default configurationSecureHeaders::Configuration.override(:script_from_otherdomain_com)do |config|
config.csp[:script_src] << "otherdomain.com"end# overrides the :script_from_otherdomain_com configurationSecureHeaders::Configuration.override(:another_config,:script_from_otherdomain_com)do |config|
config.csp[:script_src] << "evenanotherdomain.com"endendclassMyController < ApplicationControllerdefindex# Produces default-src 'self'; script-src example.org otherdomain.orguse_secure_headers_override(:script_from_otherdomain_com)enddefshow# Produces default-src 'self'; script-src example.org otherdomain.org evenanotherdomain.comuse_secure_headers_override(:another_config)endend

[stve]

missing a : here

[oreoshake]

This code is now running on github.com. I'll let it sit for a few days and release a 3.0 gem. I'll add an "upgrading to 3.0 wiki" entry in the meantime since it is very much a breaking change.