Serve template pages with a frame-ancestors CSP

Template pages now serve with `Content-Security-Policy: frame-ancestors *` to allow embedding in the builder picker's inline preview on non-Frappe Cloud sites.