feat: set x-frame-options to sameorigin instead to deny

Description

How to test

Author's checklist

• I have followed the contribution guidelines
• This MR has been tested or does not change functionality
• I have added relevant merge request dependencies (if this MR has any)
• I have added the correct labels
• I have assigned reviewers (if any are relevant)
• I have edited the documentation (if the changes require it) or I have noted the need for the change if I do not have access to the documentation
• I have marked all introduced BREAKING CHANGES or necessary DEPLOYMENT NOTES in the commit message(s)

Reviewer's checklist

• This MR has been tested or does not change functionality
• This MR has correct commit message format

Other information

Tested on id-test and works as intended. (Requested by muni user)

Before:

After:

Related issues

perun-oidc-server-webapp/src/main/webapp/WEB-INF/web-context.xml

@@ -134,6 +134,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:access-denied-handler ref="oauthAccessDeniedHandler" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Userinfo endpoint -->
@@ -147,6 +150,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:expression-handler ref="oauthWebExpressionHandler" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Introspection endpoint -->
@@ -163,6 +169,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:custom-filter ref="clientCredentialsEndpointFilter" after="BASIC_AUTH_FILTER" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Dynamic registration endpoint -->
@@ -176,6 +185,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:expression-handler ref="oauthWebExpressionHandler" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Revocation endpoint -->
@@ -192,6 +204,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:custom-filter ref="clientCredentialsEndpointFilter" after="BASIC_AUTH_FILTER" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Device endpoint -->
@@ -209,6 +224,9 @@
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:access-denied-handler ref="oauthAccessDeniedHandler" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- JWK endpoint -->
@@ -221,6 +239,9 @@
         <security:custom-filter ref="logRequestFilter" after="FIRST"/>
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- Well-known -->
@@ -233,6 +254,9 @@
         <security:custom-filter ref="logRequestFilter" after="FIRST"/>
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!--Static resources -->
@@ -244,6 +268,9 @@
         <security:custom-filter ref="mdcFilter" before="FIRST"/>
         <security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <!-- GUI -->
@@ -255,6 +282,9 @@
         <security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
         <security:expression-handler ref="oauthWebExpressionHandler" />
         <security:csrf disabled="true"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <security:http auto-config="false"
@@ -284,6 +314,9 @@
         <security:custom-filter ref="samlFilter" after="BASIC_AUTH_FILTER"/>
         <security:custom-filter ref="authProcFilters" before="LAST"/>
         <security:logout logout-url="/saml/logout"/>
+        <security:headers>
+            <security:frame-options policy="SAMEORIGIN"/>
+        </security:headers>
     </security:http>
 
     <security:authentication-manager id="clientAuthenticationManager">