SecurityHeaders middleware + fix availability calculation

[bakhterets]

Security Headers

Added SecurityHeaders middleware applied to all routes, setting protective HTTP headers:

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
Content-Security-Policy	default-src 'none'
X-XSS-Protection	1; mode=block
Strict-Transport-Security	max-age=31536000; includeSubDomains

Availability Fix

Fixed two bugs in calculateAvailability() that caused TestV2GetComponentsAvailability to fail:

1. Nil pointer panic — dereferenced inc.Impact without nil check
2. Empty incidents → nil result — returned nil, nil instead of a valid 12-month array when component had no incidents

Code changes (internal/api/v2/v2.go):

• Removed early return nil, nil for empty incidents — always returns full 12-month availability
• Added inc.Impact == nil guard before dereferencing

Unit tests (internal/api/v2/v2_test.go):

• Rewrote TestCalculateAvailability with deterministic cases (100%, 50%, 20%, 0%)
• Switched to assert.InDelta for stable floating-point comparison

Integration tests (tests/v2_test.go):

• Made TestV2GetComponentsAvailability self-contained (creates its own component)
• Replaced hardcoded 2025 dates with dynamically computed midpoints — test no longer breaks as time passes