Fix X-Frame-Options HTTP header for embed and force it to SAMEORIGIN value for other pages

Related issue: #1022 (closed)

This Merge Request includes:

• Tests (not applicable)
• A changelog fragment (cf https://docs.funkwhale.audio/contributing.html#changelog-management)

DISCLAIMER: I've not tested this. If someone could test it - it would be cool.