Set up X-Frame-Options Header

[sleidig]

see #269 (comment)

X-Frame-Options are a http feature to prevent clickjacking and should probably set up for our app in its Dockerfile

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a , <iframe>, or . Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

[sleidig]

No immediate use cases but I do see potential to embed our app somewhere (e.g. in TolaData or Nextcloud). Also, it least our public-forms are intended to be embedded on websites nowadays.

I would therefore suggest to not implement this at the moment.