Add CSP frame-ancestors: 'none'

[pgporada]

"Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers)."

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors