[HttpFoundation] Prevent XSS in JsonResponse

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

FYI https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Send_security_headers

*Note*: Please, close previous PR into 2.7 branch https://github.com/symfony/symfony/pull/13101
Thanks, my mistake :)