security: prevent cross-origin framing

[Navesz]

Summary

• deny framing through CSP frame-ancestors
• add the X-Frame-Options compatibility header
• update the locked nanoid transitive dependency to its patched release
• document and test the clickjacking protection

Validation

• npm run lint
• npx tsc --noEmit
• npm test (137 tests)
• npm audit --omit=dev (0 vulnerabilities)