Send `X-Frame-Options` header only for web pages

Sending the `X-Frame-Options` header for everything by default,
doesn't bring any value when it comes to providing clickjacking
protection.

Even if some developers may want to send this header for some
other content (e.g. images) to block websites from using it,
for the majority, that won't be the case.

Ref: h5bp/server-configs-apache#8
     h5bp/server-configs-apache#9
Improve inline comments about `X-Frame-Options`

Provide more information on the advantages and disadvantages of sending
the `X-Frame-Options` header, but also inform on what kind of web pages
it shoud be send for.

Ref: h5bp/server-configs-apache#8
     h5bp/server-configs-apache#9
Add ex. on how to mitigate reflected XSS attacks

Give example on how to make Apache mitigate reflected (a.k.a non-
persistent) Cross-Site Scripting (XSS) attacks simply by sending
the `X-XSS-Protection` header with the value of `1; mode=block`.

`X-XSS-Protection: "1; mode=block"` essentially:

 * enables the Cross-Site Scripting (XSS) filter built into
   the most recent web browsers
 * prevents web browsers from rendering the web page if a
   potential reflected XSS attack is detected by the filter

The functionality is implemented in IE 8+, Chrome and Safari
(http://blog.chromium.org/2010/01/security-in-depth-new-security-features.html)
and may soon be come to Firefox
(https://bugzilla.mozilla.org/show_bug.cgi?id=680771).

See also:

  * http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx
  * http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx
  * http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/
  * https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

Close h5bp/server-configs-apache#8