Fix XSS issue in a HTML attachment preview

Reported by aikido_security

program/include/rcmail_action.php

@@ -683,6 +683,9 @@ abstract class rcmail_action
             header('Content-Type: ' . $file['mimetype']);
             header('Content-Length: ' . $file['size']);
 
+            // Use strict security policy to make sure no javascript is executed
+            header("Content-Security-Policy: script-src 'none'");
+
             if (isset($file['data']) && is_string($file['data'])) {
                 echo $file['data'];
             }