Add support for user-defined <iframe> origins via Content-Security-Policy

[KazWolfe]

Describe your core improvement

It may be desirable for certain users to embed Home Assistant as an <iframe> into other applications, such as wall tablets, SSO providers, or as integrations with other dashboard solutions. This can be done with a theoretical configuration:

http:
  allowed_iframe_origins:
    - file:
    - https://sso.example.com
    - http://*.myhome.internal

This will then generate a Content-Security-Policy allowing these frames. For compatibility, it also would make sense to continue shipping X-Frame-Options for legacy browsers that may not support CSP.

Content-Security-Policy: frame-ancestors file: https://sso.example.com http://*.myhome.internal self;
X-Frame-Options: SAMEORIGIN

As (modern) browsers will ignore X-Frame-Options if frame-ancestors is set, only the specified origins will be permitted.

Users constrained to legacy browsers that understand X-Frame-Options but not CSP's frame-ancestors (a very small subset) would still be able to disable X-Frame-Options via the already-existing use_x_frame_options header.

Current limitations

At present, this can only be done by setting http.use_x_frame_options to false, allowing Home Assistant to embedded by anybody. This, in turn, re-opens the security vulnerability that this feature aimed to close.

Technical benefits

This allows users more control over when and where iframes can be embedded based on their own risk profiles, and prevents re-opening the full security hole exposed by disabling X-Frame-Options outright.

This could (may?) also be used as a launch point to support even more Content-Security-Policy settings through different schemas, e.g.:

http:
  content_security_policy:
    frame_ancestors:
      - file:
      - https://sso.example.com
      - http://*.myhome.internal
    script_src:  # implicit `self`
      - http://cdn.myhome.internal

Additional context

I'd be happy to take a stab at implementing this via PR, assuming certain design considerations are solidified in a way that satisfies project requirements.