False positive: Missing X-Frame-Options HTTP header

**Description of the false positive**

In a c# project, we are using NWebsec.AspNetCore.Middleware's ([docs](https://docs.nwebsec.com/en/latest/nwebsec/NWebsec.AspNetCore.Middleware.html)) ApplicationBuilderExtensions to set the X-Frame-Options policy. The scanner, however, reports Missing X-Frame-Options HTTP header (cs/web/missing-x-frame-options) as it is only checking the Web.config, I assume.
Any suggestions on mitigation? Thanks!

**Code samples or links to source code**

```csharp
//set x-Frame-Options policy="SameOrigin"
app.UseXfo(options => options.SameOrigin());
```