Support couchapp attachments

[cesine]

closes #142

Couchapp attachments are vulnerable to a permissions escalation https://docs.couchdb.org/en/stable/cve/2021-38295.html

• use the same csp as _utils for localhost testing
• add the headers to the proxy so that only signed files can be executed in the couchapps like the prototype that are not writable by users