remove XFrameOptionsMiddleware

[sennierer]

given that we use CSP we shouldnt need additionally the XFrameOptionsMiddleware

apis-acdhch-default-settings/apis_acdhch_default_settings/settings.py

Line 133 in 9a37833

"django.middleware.clickjacking.XFrameOptionsMiddleware",

[sennierer]

agreed in JFX to remove that

[koeaw]

Based on this week's JF, this issue is probably outdated? I.e. the clickjacking MIDDLEWARE vs. CSP variables need further exploration.

Summary of what I said on Mattermost afterwards:
It's possible we've been using the wrong CSP variable so far, i.e. should be using CSP_FRAME_ANCESTORS together with the clickjacking MIDDLEWARE instead of CSP_FRAME_SRC.

Relevant links:

• Django docs on Clickjacking Protection
• Mozilla docs on obsolete X-Frame-Options setting ALLOW-FROM origin
• Mozilla docs on replacing it with frame-ancestors
• django-csp policy settings docs listing the available variables (for v3.8)