Deal with X-Frame-Options for cross-origin websites in the SPA SDK demos

Problem:
At the moment, HST returns `X-Frame-Options: SAMEORIGIN` that makes it impossible to load an external website inside the channel manager iframe (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).

Solution:
When the SPA mode is enabled, we can return `Content-Security-Policy: frame-ancestors 'self' https://www.example.com` instead of `X-Frame-Options` (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors).