MAGETWO-43510: x-frame-options missing from setup

- add missing header to static file request urls

Author: eddielau

nginx.conf.sample

@@ -34,6 +34,7 @@ location /setup {
         fastcgi_index  index.php;
         fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
         include        fastcgi_params;
+        add_header X-Frame-Options "SAMEORIGIN"
     }
 
     location ~ ^/setup/(?!pub/). {
@@ -50,12 +51,14 @@ location /update {
         fastcgi_index  index.php;
         fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
         include        fastcgi_params;
+        add_header X-Frame-Options "SAMEORIGIN"
     }
 
     # deny everything but index.php
     location ~ ^/update/(?!pub/). {
         deny all;
     }
+    add_header X-Frame-Options "SAMEORIGIN"
 }
 
 location / {
@@ -76,6 +79,7 @@ location /static/ {
     }
     location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
         add_header Cache-Control "public";
+        add_header X-Frame-Options "SAMEORIGIN"
         expires +1y;
 
         if (!-f $request_filename) {
@@ -84,6 +88,7 @@ location /static/ {
     }
     location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
         add_header Cache-Control "no-store";
+        add_header X-Frame-Options "SAMEORIGIN"
         expires    off;
 
         if (!-f $request_filename) {
@@ -105,11 +110,13 @@ location /media/ {
 
     location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
         add_header Cache-Control "public";
+        add_header X-Frame-Options "SAMEORIGIN"
         expires +1y;
         try_files $uri $uri/ /get.php?$args;
     }
     location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
         add_header Cache-Control "no-store";
+        add_header X-Frame-Options "SAMEORIGIN"
         expires    off;
         try_files $uri $uri/ /get.php?$args;
     }