# description
Either edge TLS policy (scope: edge — public-facing protocol/HSTS/CSP) or internal transport security (scope: internal — sidecar channels, NATS/Redis posture). Discriminated by `scope`.

# $comment
Discriminated-union shape — strictness lives in each `oneOf` branch via `additionalProperties: false`. Setting it at root would reject the per-scope keys defined only inside the matching branch.

# $defs.securityHeaders.properties.per_site.$comment
Headers whose value legitimately varies per hosting site (e.g. COOP must allow popups on the OAuth-popup webapp; CORP must be cross-origin on the public schemas surface). Each header declares a `default` applied to every site plus optional `by_site` overrides.