Remove `AllowFromStrategy` in favor of `ContentSecurityPolicy`

[therepanic]

I also had to remove two methods from XFrameOptionsHeaderWriterTests that are no longer relevant. However, in order not to delete the test, I added my own custom test for the XFrameOptionsHeaderWriter#writeHeaders method.

Closes: gh-17307