Add a new bug check "X-Frame-Options Header Not Set"

[aaron-haskins]

To detect clickjacking vulnerability in Spring Security, we can check if X-Frame-Options header is set:

@Override
protected void configure(HttpSecurity http) throws Exception {
	http
	// ...
	.headers()
		.frameOptions()
			.deny();  // or sameOrigin()

Can such a check be added?

[aaron-haskins]

Just found that Default Security Headers have:
X-Frame-Options: DENY