security(http): Adds anti-clickjacking header when serving pages

Adds a header that prevents framing pages from different domains in
modern browsers. A plugin hook allows disabling/altering the headers
sent.

Fixes #6098
docs(hooks): Corrects docs syntax error
Merge pull request #6380 from Srokap/pr/6331