Configurable frame-ancestors and CSP for iframe embed and silent refresh

## What

authentik sends X-Frame-Options/CSP that block iframe embedding and silent token refresh; both ask for configurable frame/CSP headers. Also: CSP: #16279 is an operator putting a strict CSP in front of authentik and breaking the admin UI — the flip side of #5762/#9712 asking authentik to emit configurable CSP.

## Want

- Authentik sends X-Frame-Options/CSP that block iframe embedding
- Silent token refresh
- Both ask for configurable frame/CSP headers
- Related CSP: #16279 is an operator putting a strict CSP in front of authentik
- Breaking the admin UI — the flip side of #5762/#9712 asking authentik to emit configurable CSP

## Ideas this came from

- [#5762 Allow iframe embedding / respect Content-Security-Policy header](https://github.com/goauthentik/authentik/issues/5762) — Currently it seems not to be possible to embed pages/services protected with Authentik as iframes in other pages. E.g. I embed several pages/services as externa
- [#9712 Add support for setting X-FRAME-OPTIONS and CSP](https://github.com/goauthentik/authentik/issues/9712) — When doing silent refresh with oidc-client-ts authentik returns X-FRAME-OPTIONS: deny, making it impossible to refresh a token. Since the accesstoken lifetime i
- [#16279 Content-Security-Policy configuration](https://github.com/goauthentik/authentik/issues/16279) — Describe your question/ I’m trying to configure a strict Content-Security-Policy in front of authentik (running via Docker, behind nginx). When I set: script-sr

The issue names no files, tests, or entry points. Start by tracing where authentik emits X-Frame-Options and CSP for iframe embedding and silent token refresh; done means those headers are configurable without breaking the admin UI or the requested refresh and embedding flows.

Written by the indexing model from the issue text.