feat: export header builders and add security header audit tests

[aniokedianne]

Closes #1773
Closes #1774
Closes #1775
Closes #1759

What changed

buildHsts and buildPermissionsPolicy were unexported private functions, but securityHeaders.test.ts already imported them — causing silent undefined imports at test time. This PR exports both helpers and adds a Security Header Audit describe block that implements the automated CI check called for in #1773.

New audit tests

• Verifies all 5 required headers (Strict-Transport-Security, Permissions-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) are emitted with default options.
• X-Content-Type-Options is always nosniff regardless of custom HSTS/Permissions options.
• Referrer-Policy is always strict-origin-when-cross-origin.
• X-Frame-Options is always SAMEORIGIN.
• HSTS max-age is ≥ 31,536,000 s (1 year) by default, meeting Chrome/Firefox preload eligibility.
• payment feature-policy is 'none' by default (no inadvertent Payment Request API exposure).
• applySecurityHeadersToResponse skips all headers when headersSent is true (missing test for this guard).

[drips-wave]

@aniokedianne Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits