allow the prevention of the LMS/CMS from being renderable in an iframe

@jbau @cpennington @mikigoyal want to take a look? I change the configuration a bit and added a unit test.

This will help with the work we need to do for our customer (we'll set the X_FRAME_OPTIONS in our lms.envs.json), but the default behavior will be the same for edx.org.

My sense is that we'll have to investigate the various impacts between Drupal/Open edX a bit more before turning on in edx.org.