Explain X-XSS-Protection:0 recommendation

[valentijnscholten]

I was surprised to see the recommendation to not set or disable the X-XSS-Protection header. Then I remembered reading some articles about enabling it could have the opposite effect, i.e. more XSS.

This PR adds a link to the XSS prevention cheat sheet which does a good job of explain why it should be turned off. Could be handy for those who are not yet "in the know" of these reasons.

Please make sure that for your contribution:

• In case of a new Cheat Sheet, you have used the Cheat Sheet template.
• All the markdown files do not raise any validation policy violation, see the policy.
• All the markdown files follow these format rules.
• All your assets are stored in the assets folder.
• All the images used are in the PNG format.
• Any references to websites have been formatted as TEXT
• You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
• The CI build of your PR pass, see the build status here.