♻️ Block iframe embeds

[esizer]

♻️ Debt/Refactor

We currently do not have a policy header for frames and should add one.

🕵️ Details

I do not think we use iframes anywhere on the site so we should probably just block them outright?

🙋‍♀️ Proposed Solution

Add the following headers (one we have and you just need to append to the CSP).

Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

✅ Acceptance Criteria

• Frame ancestors set to none in our CSP
• X-Frame-Options header set to DENY

[tristan-orourke]

We need to check if our logout process uses an iframe.
If it does, we can add it to a whitelist.