Remove `X-Frame-Options` from default settings

[torgeirl]

The default settings sets the X-Frame-Options HTTP headers to 'DENY':

# https://docs.djangoproject.com/en/1.11/ref/clickjacking/
X_FRAME_OPTIONS = 'DENY'

The X-Frame-Options is more or less obsolete now, and the reason to include it would mostly be to satisfy outdated security scanners. It is overridden by frame-ancestors in Content Security Policy (CSP), but there is little point of setting in the backend instead of adding in with the proxy layer.

Workarounds a) it can be changed from 'DENY' to 'SAMEORIGIN' by overwriting X_FRAME_OPTIONS in trix_settings.py.

b) to remove it, it has to be stripped away by the proxy, ie. applying the following in Nginx's location block:

        server {
            ..
            location / {
               proxy_pass http://127.0.0.1:8002;
               ..

               proxy_hide_header X-Frame-Options;
               ..
            }
        }

[Levijatan]

Removed in cdcc742