[WIP] Use Content Security Policies instead of X-Frame-Options

Content Security Policies are supported by all major browsers while not all of X-Frame-Options is supported. For example, Chrome flat out ignores `ALLOW FROM` and just lets any site embed an iframe of the notebook (#6918).

This implements #6862, setting a default Content Security Policy and allowing for overrides in the same way that #6120 originally did for `X-Frame-Options`.

:warning: The current default completely breaks access to the notebook. Don't merge this yet. :warning:

Once we figure out the right default and do some thinking on external resource embedding, we can merge this.