Use Content Security Policies instead of X-Frame-Options

Content Security Policies are supported by all major browsers while not all of X-Frame-Options is supported. For example, Chrome flat out ignores `ALLOW FROM` and just lets any site embed an iframe of the notebook (#6918).

This implements #6862, setting a default Content Security Policy and allowing for overrides in the same way that #6120 originally did for `X-Frame-Options`.
I think you want a string first argument, like:

    self.log.debug("Error setting header: %s", e)