Block use of "<base />" in the Content Security Policy

Summary: Ref T4340. We don't use "<base />" so we can safely block it.

Test Plan: Injected "<base />" into a page, saw an error in the console showing that the browser had blocked it.

Maniphest Tasks: T4340

Differential Revision: https://secure.phabricator.com/D19158

src/aphront/response/AphrontResponse.php

@@ -154,6 +154,9 @@ abstract class AphrontResponse extends Phobject {
     // download URI instead of submitting a form to it.
     $csp[] = "form-action 'self'";
 
+    // Block use of "<base>" to change the origin of relative URIs on the page.
+    $csp[] = "base-uri 'none'";
+
     $csp = implode('; ', $csp);
 
     return $csp;