fix(web,anchor-sdk): harden markdown rendering, add security headers, cap toml reads

fix(web,anchor-sdk): harden markdown rendering, add security headers, cap toml reads #1810