Enable Play security http headers

[fm3]

sets security http headers:

X-Frame-Options: DENY
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block

(but not the ones that disrupted normal operation: X-Permitted-Cross-Domain-Policies and Content-Security-Policy)

for reference: https://www.playframework.com/documentation/2.4.x/SecurityHeaders

URL of deployed dev instance (used for testing):

• https://xframe.webknossos.xyz

Steps to test:

• react + google analytics should start normally
• autologin should still work
• datastore-related requests should not fail (e.g. start a tracing, save some update actions, download nml via backend)

Issues:

• fixes Enhance webknossos security #1685

---

• Updated changelog
• [ ] Updated migration guide if applicable
• [ ] Needs datastore update after deployment
• Ready for review

[daniel-wer]

LGTM, tested google analytics, user scripts and update actions, everything working :)