chore: add Netlify config

Author: salim-b

netlify.toml

@@ -0,0 +1,52 @@
+# ------- BUILD -------
+# documentation: https://docs.netlify.com/configure-builds/file-based-configuration/#build-settings
+[build]
+base = "docs/"
+
+# ------- HEADERS -------
+# documentation: https://www.netlify.com/docs/headers-and-basic-auth/
+[[headers]]
+for = "/*"
+[headers.values]
+# for a brief introduction into CSPs, see https://infosec.mozilla.org/guidelines/web_security#content-security-policy
+# for an in-depth description, see [An Introduction to Content Security Policy](https://www.html5rocks.com/en/tutorials/security/content-security-policy/)
+# for an up-to-date list of available policies, see
+# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+# - [OWASP CSP Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Content_Security_Policy_Cheat_Sheet.md)
+# notes:
+# - `connect-src data:` is required for asciinema (asciicast)
+# - `connect-src https://t.counter.dev` is required for counter.dev analytics
+# - `object-src 'self';` has to be set to enable PDF preview in Chrome
+# - `img-src https://r-pkg.org` has to be set for the CRAN badge in the README
+# - `script-src 'unsafe-eval'` is required for MathJax, cf. https://github.com/mathjax/MathJax/issues/1988#issuecomment-384978927
+# - `script-src https://rpkg.dev` is required for counter.dev analytics
+# - `style-src 'unsafe-inline'` is required for MathJax, cf. https://github.com/mathjax/MathJax/issues/1988#issuecomment-581567775
+Content-Security-Policy = '''
+  base-uri 'self';
+
+  default-src 'none';
+  connect-src 'self' data: https://t.counter.dev;
+  font-src 'self';
+  img-src 'self' data: https://r-pkg.org;
+  manifest-src 'self';
+  object-src 'self';
+  script-src 'self' 'unsafe-eval' https://rpkg.dev;
+  style-src 'self' 'unsafe-inline';
+
+  form-action 'self';
+  frame-ancestors 'none'
+'''
+Referrer-Policy = "strict-origin-when-cross-origin"
+X-Content-Type-Options = "nosniff"
+X-Frame-Options = "DENY"
+X-XSS-Protection = "1; mode=block"
+
+# ------- REDIRECTS -------
+# Redirect rules are processed [from top to bottom](https://docs.netlify.com/routing/redirects/#rule-processing-order), i.e. first matching one has priority
+
+# fall back to dev site (non-shadowing), so that links not (yet) available in stable site are automatically redirected to dev version if present
+[[redirects]]
+from = "/*"
+to = "/dev/:splat"
+status = 302
+force = false