add more security headers

thanks to @J0WI (#52)

Author: Findus23

sites-available/matomo.conf

@@ -23,6 +23,8 @@ server {
     include ssl.conf; # if you want to support older browsers, please read through this file
 
     add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
 
     root /var/www/matomo/; # replace with path to your matomo instance