security(http): Adds anti-clickjacking header when serving pages

Adds a header that prevents framing pages from different domains in
modern browsers. A plugin hook allows disabling/altering the headers
sent.

Fixes #6098