fix: [security] X-FRAME-OPTIONS: DENY added to all responses

- as reported by SK-CERT

src/Controller/AppController.php

@@ -149,6 +149,7 @@ class AppController extends Controller
             if ($this->modelClass == 'Tags.Tags') {
                 $this->set('metaGroup', !empty($this->isAdmin) ? 'Administration' : 'Cerebrate');
             }
+            $this->response = $this->response->withHeader('X-Frame-Options', 'DENY');
         }
         if (mt_rand(1, 50) === 1) {
             $this->FloodProtection->cleanup();