mmdvmhost/lh.php (and admin/mmdvmhost/lh.php) require_once this file
and call setEmbeddableSecurityHeaders(), but the file was never
committed to this repo (confirmed absent across main/dev/development
history), causing a fatal "failed opening required" 500 on the Last
Heard panel.
Restores both setSecurityHeaders() (full page: adds X-Frame-Options +
CSP frame-ancestors) and setEmbeddableSecurityHeaders() (AJAX partial
variant, omits the framing directives since it's loaded into the
parent via $.load(), not an iframe), matching the behavior described
in the comments already present in lh.php and functions.php.
yuancheng