[HttpFoundation] Prevent XSS in JsonResponse

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

FYI https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Send_security_headers