Reworking Content-Security-Provider and X-FRAME-OPTION headers to allow fine tuned
values.  Rather than a blanket "no, don't frame" we want selective framing allowed
for particular applications and maybe other parameters (e.g. by user or group).

@rev amcculloch@
@bug W-2390049@
Merging origin/fabbott/master-pending/cspxfo into master