`SilentRefresh` headers are missing in some response(s)

## Steps to reproduce

1. Do a simple request, e.g. `https://host.docker.internal:9200/.well-known/openid-configuration`
2. Check `X-Frame-Options` in response -> it'll show `DENY`

That might be correct for this concrete example, but at least for some request(s), it should show `SAMEORIGIN` (just like the Web service does because of the [SilectRedirect middleware](https://github.com/owncloud/ocis/blob/master/services/web/pkg/middleware/silentrefresh.go#L8)). I believe we need that (at least) in the response from `https://host.docker.internal:9200/konnect/v1/session/check-session.html`.

fyi @micbar This blocks handling the backchannel logout properly in Web. We need the headers from the `SilentRefresh` middleware.