Set X-Frame-Options to DENY for transactions

We should explicitly deny framing of any kind for pages that link to
external transactions. This makes clients that understand it behave more
securely in these circumstances.
Deny framing of local transactions
Merge pull request #511 from alphagov/deny-framing-on-transaction-start-page

Set X-Frame-Options to DENY for transactions