Merge branch 'dz-api-x-frame' into 'security-9-2'

Restrict API X-Frame-Options to same origin

See merge request !2103

lib/api/api.rb

@@ -45,6 +45,7 @@ module API
     end
 
     before { allow_access_with_scope :api }
+    before { header['X-Frame-Options'] = 'SAMEORIGIN' }
     before { Gitlab::I18n.locale = current_user&.preferred_language }
 
     after { Gitlab::I18n.use_default_locale }