Add X-FRAME-OPTIONS, DENY.

Following app sec test, XFS mitigation is documented in:

- https://www.owasp.org/index.php/Clickjacking_Protection_for_Java_EE
- http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

The first approach is to add X-FRAME-OPTION: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

- Apache: http://httpd.apache.org/docs/2.2/mod/mod_headers.html#header
- NGiNX: http://nginx.org/en/docs/http/ngx_http_headers_module.html
Add framebreaker script.

After app sec test, another XFS attack mitigation is to prevent pages
from being framed.
See https://www.owasp.org/index.php/Clickjacking_Protection_for_Java_EE
Fix save_bundles ls repo detection.

Two repos `aaa` and `aaa_bbb` would be listed before this fix.
`aaa-*.bundle` would only detect the first.