Add configuration for the `frame-ancestors` value of CSP
    
    Add a configuration option to set the domains allowed to display Ipsilon
    in a frame / iframe / embed using Content Security Policy.
    
    Also, `X-Frame-Options` is deprecated and replaced by Content Security
    Policy, remove it.
    
    Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2235532
    
    Signed-off-by: Aurélien Bompard <aurelien@bompard.org>