This fixes an issue with rendering sandboxed
mermaid diagrams for self-hosted instances without
CSP enabled

- Update X-Frame-Options to use SAMEORIGIN
- Enable :sandbxoed_mermaid flag by default

Changelog: added