Disable embedding for initial serverless offering

[legrego]

Blocked on #153274.

The initial serverless offering should not be embeddable. Kibana already exposes this configuration option, so we'll "just" have to adjust the default configuration when running in a serverless context:

server.securityResponseHeaders.disableEmbedding: true

Docs for this setting:

kibana/docs/setup/settings.asciidoc

Lines 419 to 423 in 6ad108d

	[[server-securityResponseHeaders-disableEmbedding]]`server.securityResponseHeaders.disableEmbedding`::
	Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy[`Content-Security-Policy`] and
	https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options[`X-Frame-Options`] headers are configured to disable embedding
	{kib} in other webpages using iframes. When set to `true`, secure headers are used to disable embedding, which adds the `frame-ancestors:
	'self'` directive to the `Content-Security-Policy` response header and adds the `X-Frame-Options: SAMEORIGIN` response header. *Default:* `false`

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[legrego]

Closing in favor of #150884