fix: add Permissions-Policy header to suppress browsing-topics warning

Added Permissions-Policy header with browsing-topics=() to suppress console
warnings about unrecognized Privacy Sandbox API features. Header is now applied
in all environments (dev and prod) while other security headers remain
production-only.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

lib/towerops_web/plugs/security_headers.ex

@@ -7,6 +7,7 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   - X-Frame-Options: Prevents clickjacking attacks
   - X-Content-Type-Options: Prevents MIME type sniffing
   - Referrer-Policy: Controls referrer information leakage
+  - Permissions-Policy: Disables browsing-topics API
 
   These headers are only applied in production to avoid interfering with
   development tools like LiveReload.
@@ -17,6 +18,12 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   def init(opts), do: opts
 
   def call(conn, _opts) do
+    conn
+    |> put_resp_header("permissions-policy", "browsing-topics=()")
+    |> maybe_add_prod_headers()
+  end
+
+  defp maybe_add_prod_headers(conn) do
     if Application.get_env(:towerops, :env) == :prod do
       conn
       |> put_resp_header("content-security-policy", csp_header())