Add a frame-ancestors allow list option to Content-Security-Policy

[peetahzee]

Motivation for features / changes

Add an allowlist to allow TensorBoard to embedded as an iframe in other apps

Technical description of changes

By default, browsers disallow any webpages to be iframed in other external apps unless a Content-Security-Policy frame-ancestors header is set. This change exposes an option to customize that header.

Screenshots of UI changes (or N/A)

N/A

Detailed steps to verify changes work correctly (as executed by you)

Added unit test and verified headers show up as expected.

Alternate designs / implementations considered (or N/A)

N/A

[peetahzee]

Turns out this option is unnecessary. By default, not setting frame-ancestors means that all URLs are accepted as frame ancestors. In other words, as it is, TensorBoard can already be iframed by any page.