Remove CORP and similar headers entirely

(and ignore corresponding ZAP finding as these headers
 seem to break the SSTi challenge when app is running in
 a subfolder)

.zap/rules.tsv

@@ -12,3 +12,4 @@
 10049	IGNORE	(Storable but Non-Cacheable Content)
 10049	IGNORE	(Non-Storable Content)
 10110	IGNORE	(Dangerous JS Functions)
+90004	IGNORE	(Insufficient Site Isolation Against Spectre Vulnerability)

server.js

@@ -172,12 +172,6 @@ app.use(featurePolicy({
     payment: ["'self'"]
   }
 }))
-app.use(function (req, res, next) {
-  // res.setHeader('Cross-Origin-Resource-Policy', 'same-site')
-  // res.setHeader('Cross-Origin-Opener-Policy', 'same-origin-allow-popups')
-  // res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
-  next() // TODO Replace above manually set headers with helmet solution once supported (see https://github.com/helmetjs/helmet/issues/176)
-})
 
 /* Remove duplicate slashes from URL which allowed bypassing subsequent filters */
 app.use((req, res, next) => {