[CSP] enhancements to example policy

[Malvoz]

Fix #156

Also, with these changes the CSP frame-ancestors directive description now mentions the relation to X-Frame-Options (https://w3c.github.io/webappsec-csp/#frame-ancestors-and-frame-options). Seems logical X-Frame-Options should say something about frame-ancestors/CSP? I can probably do that tomorrow, really tired atm. :)

[LeoColomb]

Wow, impressive PR, thanks a lot @Malvoz! 👍
As you may expect, some comments (inline). 😉

[Malvoz]

form-action is a navigation directive, only fetch directives falls back to default-src.

Do you want me to clarify that, here(?):

server-configs-apache/src/security/content-security-policy.conf

Lines 35 to 36 in a397654

	# (3) Form submissions are only allowed from the current website by
	# setting: `form-action 'self'`.

[LeoColomb]

Technically LGTM.

May be relevant to add reflected-xss block too, but not mandatory.