C#: Reduce false positives in cs/web/missing-x-frame-options

[Bubby4j]

Summary

The cs/web/missing-x-frame-options query was primarily modeled around legacy ASP.NET Framework applications hosted by IIS. As a result, it could report false positives for ASP.NET Core applications that correctly configure clickjacking-related response headers in code.

This change:

• recognizes X-Frame-Options written through ASP.NET Core HttpResponse.Headers
• recognizes enforced Content-Security-Policy headers containing a frame-ancestors directive
• supports header dictionary indexers, named header properties, and Append, Add, and TryAdd
• handles header names and CSP directive names case-insensitively

Legacy ASP.NET Framework and Web.config handling remains supported.

Testing

• Added positive and negative tests for ASP.NET Core response-header writes.
• Added Web.config tests for CSP frame-ancestors handling.