fix: improvements for login and oidc (#227)

* add csrf

* caching

* caching

* caching

* caching

* security headers

* csp and security headers

* error handler csp

* select user with display name

* csp

* user selection styling

* username to loginname

* regenerate grpc

* regenerate

* change to login name

internal/api/header.go

@@ -4,12 +4,23 @@ const (
 	Authorization  = "authorization"
 	Accept         = "accept"
 	AcceptLanguage = "accept-language"
+	CacheControl   = "cache-control"
 	ContentType    = "content-type"
+	Expires        = "expires"
 	Location       = "location"
 	Origin         = "origin"
+	Pragma         = "pragma"
 	UserAgent      = "user-agent"
 	ForwardedFor   = "x-forwarded-for"
 
+	ContentSecurityPolicy   = "content-security-policy"
+	XXSSProtection          = "x-xss-protection"
+	StrictTransportSecurity = "strict-transport-security"
+	XFrameOptions           = "x-frame-options"
+	XContentTypeOptions     = "x-content-type-options"
+	ReferrerPolicy          = "referrer-policy"
+	FeaturePolicy           = "feature-policy"
+
 	ZitadelOrgID = "x-zitadel-orgid"
 	//TODO: Remove as soon an authentification is implemented
 	ZitadelUserID   = "x-zitadel-userid"