Use X-Frame-Options: SAMEORIGIN instead of DENY

Previously Spring Security was the content from being framed using the
X-Frame-Options: DENY header. This is the default behavior with Java
Configuration to help protect sites from clickjacking. This caused
problems with the h2 admin URLs since it used frames.

Now the Security configuration has been updated to use the
X-Frame-Options: SAMEORIGIN header which allows framing the content
but only if it comes from the same domain. This allows the h2 admin
Servlet to render its UI.