new_audit: ensure clickjacking mitigation through XFO or CSP

[sebastian9er]

Summary
Adding a new audit to Ligththouse, which detects missing Clickjacking mitigation through the X-Frame-Options or Content-Security-Policy HTTP header.

Part of a larger change to introduce more similar header deployments.

Similar to the HSTS audit (#16257), the description contains a placeholder doc link until the internal doc is approved. @adamraine FYI

[adamraine]

Can you revert your changes to cli/test/smokehouse/frontends/smokehouse-bin.js

[adamraine]

Suggested change

description: 'Deployment of either the X-Frame-Options or Content-Security-Policy (with the frame-ancestors directive) header will prevent Clickjacking attacks. While the XFO header is simpler to deploy, the CSP header is more flexible. [Learn more about mitigating Clickjacking with XFO and CSP](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation).',

description: 'The `X-Frame-Options` (XFO) header or the `frame-ancestors` directive in the `Content-Security-Policy` (CSP) header can be used to mitigate clickjacking attacks. While the XFO header is simpler to deploy, the `frame-ancestors` CSP directive is more flexible. [Learn more about mitigating clickjacking](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation).',

Also what makes the XFO simpler to deploy? Seems like they have the same level of complexity to deploy (just modify header values).

[adamraine]

Suggested change

	noClickjackingMitigation: 'No Clickjacking mitigation found.',
	noClickjackingMitigation: 'No XFO or CSP frame-ancestors found',

[adamraine]

Suggested change

	// If there is none of the two headers, return early.
	if (!rawXfo.length && !cspHeaders.length) {
	return {
	score: 0,
	results: [{
	severity: str_(i18n.UIStrings.itemSeverityHigh),
	description: str_(UIStrings.noClickjackingMitigation),
	directive: undefined,
	}],
	};
	}

This is redundant, if the header lists are empty we will just skip to the bottom anyway.

[adamraine]

Suggested change

	// Check for frame-ancestors in CSP.
	if (cspHeaders.length) {
	for (const cspDirective of cspHeaders) {
	if (cspDirective.includes('frame-ancestors')) {
	// Pass the audit if frame-ancestors is present.
	return {score: 1, results: []};
	}
	}
	}
	// Check for frame-ancestors in CSP.
	for (const cspHeader of cspHeaders) {
	if (cspHeader.includes('frame-ancestors')) {
	// Pass the audit if frame-ancestors is present.
	return {score: 1, results: []};
	}
	}