Opinionated defaults for API servers

Hey,

the headers seem to be targeted more towards serving server-side rendered/served webpages. While there is a use-case to lock down your pure NodeJS API servers with security headers.

I could see the following API surface using default targeted toward pure APIs:

app.use(
  helmet.apiDefaults()
)

Example headers (taken from GitHub API) could include (non-complete):

content-security-policy: default-src 'none'
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0