Draft: Replace X-Frame-Ancestors with Content-Security-Policy

Geoff Applebyrequested to merge
issue/drupal-2513356:2513356-csp-in-core into main

Closes #2513356

Merge request reports