Re-enable sanboxed mermaid FF with a fix

This fixes an issue with rendering sandboxed
mermaid diagrams for self-hosted instances without
CSP enabled

- Update X-Frame-Options to use SAMEORIGIN
- Enable :sandbxoed_mermaid flag by default

Changelog: added

app/controllers/application_controller.rb

@@ -273,7 +273,7 @@ class ApplicationController < ActionController::Base
   end
 
   def default_headers
-    headers['X-Frame-Options'] = 'DENY'
+    headers['X-Frame-Options'] = 'SAMEORIGIN'
     headers['X-XSS-Protection'] = '1; mode=block'
     headers['X-UA-Compatible'] = 'IE=edge'
     headers['X-Content-Type-Options'] = 'nosniff'

config/feature_flags/development/sandboxed_mermaid.yml

@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/349755
 milestone: '14.7'
 type: development
 group: group::analyzer frontend
-default_enabled: false
+default_enabled: true