Fix Cross-Origin-Opener-Policy header on static error pages

[alikabeel-spooner]

Static error pages (404, 500, etc.) served from the public/ directory were not receiving the Cross-Origin-Opener-Policy header because they bypass the Rails controller stack and the action_dispatch.default_headers configuration.

This fix adds a SecurityHeaders middleware at position 0 in the middleware stack to ensure all responses, including static error pages, receive the COOP header. This prevents XS-leak attacks where malicious sites can control window navigation after opening rubygems.org.

[colby-swandale]

Any particular reason why this was re-opened from #5442 ?

[alikabeel-spooner]

Any particular reason why this was re-opened from #5442 ?

Yes, the Rails team mentioned this should be in the frameworks that believe it adds security value. I also I believe this version is cleaner than the other one. Finally, the HackerOne report has been opened for ages and I would love to fix it and get it resolved.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.98%. Comparing base (fd36db9) to head (f20ca65).
⚠️ Report is 27 commits behind head on master.

Files with missing lines	Patch %	Lines
lib/gemcutter/middleware/security_headers.rb	0.00%	11 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6274      +/-   ##
==========================================
- Coverage   38.65%   37.98%   -0.67%     
==========================================
  Files         487      488       +1     
  Lines       10728    10798      +70     
==========================================
- Hits         4147     4102      -45     
- Misses       6581     6696     +115     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.