Consider adding a Page or API method attribute to control X-Frame-Options

Please correct me if I'm wrong, but it does not seem that there is a way to turn off the injected `X-Frame-Options` header except globally or via a custom middleware for more fine-grained control. As the headers are set after page handler methods are called, attempting to remove the header by manipulating `Response.Headers` is of no use, and unfortunately there is no value for `X-Frame-Options` corresponding to "allow all", which is the defined by the absence of the header.

### Describe the solution you'd like
Similar to how it is possible to decorate pages or routes with `[IgnoreAntiforgeryToken]`, it would probably be useful and not over the top to introduce a `[SuppressXFrameOptions]` decoration for pages or api methods/routes to conditionally suppress the generation of `X-Frame-Options` without globally disabling it via `AntiforgeryOptions.SuppressXFrameOptionsHeader`.

### Use case
We have an integration component that customers can host in iframes on their own website at a single endpoint, but otherwise have been enjoying the automatic generation of `X-Frame-Options` for the rest of the site.