Use Content Security Policies instead of X-Frame-Options

Content Security Policies are supported by all major browsers while not all of X-Frame-Options is supported. For example, Chrome flat out ignores `ALLOW FROM` and just lets any site embed an iframe of the notebook (#6918).

This implements #6862, setting a default Content Security Policy and allowing for overrides in the same way that #6120 originally did for `X-Frame-Options`.
How about:

    self.log.warn("Content security policy violation: %s", self.request.body.decode('utf8', 'replace'))