Consider managing allowed frame ancestors via AWS lambda

[julianjelfs]

We can in principle add a lambda function to our AWS cloudfront distribution that will check the origin of the request and return a dynamic content security policy (specifically frame-ancestors). This might make things easier to manage.