#610 Add frame-ancestors 'self' to the content security policy

[ajs-uk-dev]

Closes #610 (part of the OWASP set #607).

frame-ancestors is the CSP directive that decides which sites may put the service in a frame; it replaced X-Frame-Options in current browsers. The policy had no such directive, and the app has never set X-Frame-Options — the middleware's remark said it did, and that is corrected here — so whether a page could be framed depended on whatever sat in front of the app.

• frame-ancestors 'self' joins ContentSecurityPolicyBase in SecurityHeadersMiddleware; nothing else in the policy changes ('unsafe-inline' / 'unsafe-eval' are Remove 'unsafe-inline' and 'unsafe-eval' from the CSP script-src #611).
• SecurityHeadersMiddlewareTests.FrameAncestors_AllowsOnlyThisSite asserts the whole directive, not a substring.
• The class remark and the test file's header no longer claim X-Frame-Options.
• The technical overview lists the directive.

Tested: unit 7,479 / 0 (7,478 on main), build 0 errors. Review-app proof in a comment below.

🤖 Generated with Claude Code

[github-actions]

Review app for PR 642 was deleted

[ajs-uk-dev]

Review-app proof at ce31ba7:

$ curl -sI https://check-performance-data-pr-642.test.teacherservices.cloud/ | grep -iE "^(content-security-policy|x-frame-options):"
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms; style-src 'self' 'unsafe-inline' https://*.googletagmanager.com https://fonts.googleapis.com; img-src 'self' data: blob: https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms https://fonts.gstatic.com; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms; frame-src 'self' https://*.googletagmanager.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self' https://test-oidc.signin.education.gov.uk
X-Frame-Options: SAMEORIGIN

$ curl -sI https://check-performance-data-pr-642.test.teacherservices.cloud/robots.txt | grep -iE "^(content-security-policy|x-frame-options):"
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms; style-src 'self' 'unsafe-inline' https://*.googletagmanager.com https://fonts.googleapis.com; img-src 'self' data: blob: https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms https://fonts.gstatic.com; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.clarity.ms; frame-src 'self' https://*.googletagmanager.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self' https://test-oidc.signin.education.gov.uk

frame-ancestors 'self' is on the start page and on /robots.txt, and form-action is still the last directive.

X-Frame-Options: SAMEORIGIN appears on the start page only, not on /robots.txt. Nothing in our code sets it (the plan's grep of src/ found it only in comments), and the pattern (present on a page that renders a form, absent on a plain text route) matches ASP.NET Core's antiforgery, which adds it when it writes a token. I have not confirmed that source, so treat it as likely rather than proven. Either way it agrees with frame-ancestors 'self', and frame-ancestors takes precedence in browsers that understand both.

[github-actions]

E2E tests passed

362 passed, 0 failed, 4 skipped in 14 min 26 s

Commit 5759bcb against https://check-performance-data-pr-642.test.teacherservices.cloud (run)