Use Content Security Policies instead of X-Frame-Options

Content Security Policies are supported by all major browsers while not all of X-Frame-Options is supported. For example, Chrome flat out ignores `ALLOW FROM` and just lets any site embed an iframe of the notebook (#6918).

This implements #6862, setting a default Content Security Policy and allowing for overrides in the same way that #6120 originally did for `X-Frame-Options`.
You can get rid of the `pass` here