Security: Set the frame-ancestors directive in send_frame_options_header().

The X-Frame-Options HTTP response header is a way of controlling whether and how a document may be loaded inside of a child navigable. For sites using Content-Security-Policy, the frame-ancestors directive provides more granular control over the same situations.

Includes adding a headers_sent() check before sending the headers.

References:

• ​MDN Web Docs: X-Frame-Options header
• ​MDN Web Docs: Content-Security-Policy: frame-ancestors directive

Follow-up to [17826].

Props danielbachhuber, killerbishop, callumbw95, josephscott, nacin, chriscct7, iandunn, SergeyBiryukov.
Fixes #29429.