Add X-Frame-Options header

[sierikov]

Adds X-Frame-Options header. Part of #5010.
I don't know if we need to support a deprecated ALLOW-FROM=url directive.

[armanbilge]

I don't know if we need to support a deprecated ALLOW-FROM=url directive.

I think we might want to 😕 it's still a valid albeit deprecated value that can be encountered in the wild. And because we are modeling this as a sealed hierarchy we cannot add more cases compatibly in the future, so we need to do it now.

Sorry for the slow review cycle.

[armanbilge]

it's still a valid albeit deprecated value that can be encountered in the wild.

I take that back, now that I actually turned on my brain. This is a header is really only relevant for browsers: we might send it in a server response, but it's unlikely we'll ever parse it.

LGTM. Thank you!

[armanbilge]

Oh actually, we should test laws like we do for other headers e.g.

http4s/tests/shared/src/test/scala/org/http4s/headers/AcceptHeaderSuite.scala

Line 23 in 4c77703

checkAll("Accept", headerLaws[Accept])

I think this was missing in your other PR #6981 as well.