Reworking Content-Security-Provider and X-FRAME-OPTION headers to allow fine
values.  Rather than a blanket "no, don't frame" we want selective framing al
for particular applications and maybe other parameters (e.g. by user or group

@rev goliver@
@bug W-2390049@
@p4CL:9424935@
Merging origin/fabbott/master-pending/cspxfo-reprise into master