Improve warning for X-Frame-Options header DENY (#3808)

[coderkun]

Improve the warning when the X-Frame-Options HTTP header is set to DENY—which is a more secure level that the expected SAMEORIGIN (see #3808).

[mention-bot]

@coderkun, thanks for your PR! By analyzing the history of the files in this pull request, we identified @LukasReschke, @rullzer and @MorrisJobke to be potential reviewers.

[codecov]

Codecov Report

Merging #4856 into master will increase coverage by <.01%.
The diff coverage is 80%.

@@             Coverage Diff              @@
##             master    #4856      +/-   ##
============================================
+ Coverage     54.18%   54.19%   +<.01%     
  Complexity    22155    22155              
============================================
  Files          1363     1363              
  Lines         84842    84846       +4     
  Branches       1322     1323       +1     
============================================
+ Hits          45969    45979      +10     
+ Misses        38873    38867       -6

Impacted Files	Coverage Δ	Complexity Δ
core/js/setupchecks.js	97.11% <80%> (-0.89%)	0 <0> (ø)
lib/private/Security/CertificateManager.php	90.81% <0%> (-1.03%)	39% <0%> (ø)
lib/private/Server.php	93.4% <0%> (+0.14%)	120% <0%> (ø)	⬇️
core/js/js.js	61.78% <0%> (+0.56%)	0% <0%> (ø)	⬇️
apps/comments/lib/EventHandler.php	87.5% <0%> (+8.33%)	7% <0%> (ø)	⬇️

[MorrisJobke]

@LukasReschke Any chance to have a look at this?

[rullzer]

@LukasReschke ^^