fix(docs): even more CSP adjustments... (apache#27278)

docs/static/.htaccess

@@ -22,14 +22,15 @@ RewriteRule ^(.*)$ https://superset.apache.org/$1 [R,L]
 RewriteCond %{HTTP_HOST} ^superset.incubator.apache.org$ [NC]
 RewriteRule ^(.*)$ https://superset.apache.org/$1 [R=301,L]
 
-Header set Content-Security-Policy "default-src 'self'; img-src *;"
+# Header set Content-Security-Policy "default-src 'self'; img-src *;"
 
 Header set Content-Security-Policy "default-src 'self'; \
 script-src 'self'; \
 img-src 'self' https://static.scarf.sh *; \
 style-src 'self' https://fonts.googleapis.com; \
 script-src-elem 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com; \
 style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://analytics.apache.org https://www.bugherd.com; \
+frame-ancestors 'self' https://preset.io; \
 font-src 'self' https://fonts.gstatic.com; \
 frame-src 'self' https://calendar.google.com https://preset.io https://sidebar.bugherd.com https://unpkg.com; \
 "