Set default `frame-ancestors` on default Content-Security-Policy

We should consider setting a default `frame-ancestors` directive for the Content Security Policy. The [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) directive is the new iteration of the X-Frame-Options header, and as such setting a directive in both spots might be prudent.

https://github.com/github/secure_headers/blob/b134eef07d3741b4bd0769b863961b41af5df57d/lib/secure_headers/headers/content_security_policy_config.rb#L97

Since our default XFO policy is `sameorigin`, if we decide to take upon this task, we should set the default `frame-ancestors` value to be `self`.

Some counterpoints: setting both the `X-Frame-Options` and the `frame-ancestors` directive will cause the XFO header to be overriden by the frame-ancestors directive. This means that if a user is trying to change some framing functionality, and only changes the XFO header, they might be confused as to why the functionality didn't actually change.

從連結的預設政策附近的 lib/secure_headers/headers/content_security_policy_config.rb 開始。檢查現有的 sameorigin X-Frame-Options 預設值是如何設定的，並考量其與 frame-ancestors 的既定互動。完成的標準是釐清預設值是否應包含 frame-ancestors self，並實作這項決定，同時不讓這兩個 framing 控制以誤導性的方式保持不一致。

由索引模型根據 Issue 內容生成。