Enable Content-Security-Policy to prevent Searchworks from being embedded in a frame

[jcoyne]

We are currently seeing warnings in the browser console that says:

The 'X-Frame-Options' header should not be used. A similar effect, with more consistent support and stronger checks, can be achieved with the 'Content-Security-Policy' header and 'frame-ancestors' directive.

this enables Rails' CSP and adds the frame-ancestors