Match page response includes a Content-Security-Policy header

Response-header hygiene: Content-Security-Policy and either X-Frame-Options or frame-ancestors directive on every match page.