Remove X-Frame-Options Header

Problem/Motivation

While the X-Frame-Options: SAMEORIGIN header added by core is overridden by a frame-ancestors CSP directive, its presence may cause some confusion (particularly if frame-ancestors is not set to only 'self').

Steps to reproduce

Proposed resolution

Remove the X-Frame-Options header in CSP's response subscriber if frame-ancestors is set.

Remaining tasks

User interface changes

API changes

Data model changes