fix(plugins): correct Rust codegen serde attributes and harden endpoint responses

Fix two issues from PR #5045 review. The Rust code generator was
producing incorrect skip_serializing_if attributes: map types incorrectly
used Option::is_none instead of HashMap::is_empty, and the bare int type
for HTTPHandleResponse.Status fell through to the default Option::is_none
case. The map fix is in skipSerializingFunc; the int issue is fixed at the
source by changing Status from int to int32 (HTTP status codes always fit
in int32, and this avoids platform-dependent int sizing on i386 vs amd64).

Additionally, plugin HTTP responses now include forced security headers
(X-Content-Type-Options: nosniff and a restrictive Content-Security-Policy
with sandbox) to prevent XSS from compromised plugins serving HTML+JS on
the same origin as Navidrome.

plugins/http_endpoint.go

@@ -164,15 +164,19 @@ func (h *endpointHandler) dispatch(w http.ResponseWriter, r *http.Request, p *pl
 		return
 	}
 
-	// Write response headers
+	// Write response headers from plugin
 	for key, values := range resp.Headers {
 		for _, v := range values {
 			w.Header().Add(key, v)
 		}
 	}
 
+	// Security hardening: override any plugin-set security headers
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox")
+
 	// Write status code (default to 200)
-	status := resp.Status
+	status := int(resp.Status)
 	if status == 0 {
 		status = http.StatusOK
 	}