Enforce preview proxy frame-ancestors CSP to block remote framing (#4234)