Cross-Origin-Resource-Policy advice

[annevk]

As @mikewest noted in #733 there should be some advice as to when to use this header and that it should probably be used in conjunction with X-Frame-Options: ... at least until all browsers ship site isolation.

[Malvoz]

Should CSP's frame-ancestors be mentioned aswell?

[annevk]

Yeah, that seems reasonable.