Security hardening + new tools deployment

- Hide Apache version (ServerTokens Prod)
- Add Permissions-Policy header
- Remove deprecated X-XSS-Protection
- Consolidate security headers to .htaccess only (remove duplicates from PHP)
- Deploy free tools: robots-analyzer, data-converter
- Deploy tools announcement blog post
- Update sitemap with new tools and blog post

includes/header.php

@@ -14,6 +14,7 @@
             <a href="/#services" class="nav-link">Services</a>
             <a href="/project-types" class="nav-link">Project Types</a>
             <a href="/about" class="nav-link">About</a>
+            <a href="/tools/" class="nav-link">Free Tools</a>
             <a href="/blog/" class="nav-link">Blog</a>
             <a href="/#contact" class="nav-link">Contact</a>
             <a href="/quote" class="nav-link cta-button">Request Consultation</a>