Security hardening + new tools deployment

- Hide Apache version (ServerTokens Prod)
- Add Permissions-Policy header
- Remove deprecated X-XSS-Protection
- Consolidate security headers to .htaccess only (remove duplicates from PHP)
- Deploy free tools: robots-analyzer, data-converter
- Deploy tools announcement blog post
- Update sitemap with new tools and blog post

blog/articles/healthcare-research-data-collection.php

@@ -1,9 +1,5 @@
 <?php
 // Security headers
-header('X-Content-Type-Options: nosniff');
-header('X-Frame-Options: DENY');
-header('X-XSS-Protection: 1; mode=block');
-header('Referrer-Policy: strict-origin-when-cross-origin');
 header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\' https://www.googletagmanager.com; style-src \'self\' \'unsafe-inline\' https://fonts.googleapis.com; font-src \'self\' https://fonts.gstatic.com; img-src \'self\' data: https:; connect-src \'self\' https://www.google-analytics.com https://analytics.google.com https://region1.google-analytics.com;');
 
 // Article-specific variables
@@ -351,5 +347,6 @@ $breadcrumbs = [
     <?php include($_SERVER['DOCUMENT_ROOT'] . '/includes/footer.php'); ?>
     
     <script src="/assets/js/main.js" defer></script>
+<script src="../../assets/js/cro-enhancements.js"></script>
 </body>
 </html>