Explicit disable (unsafe) X-XSS-Protection-header

[NicolaiSoeborg]

A bit counter-intuitive, but X-XSS-Protection is actually dangerous on (old) browsers supporting the spec.

In filtering mode it easily allows attackers to remove critical blocks of JavaScript, which can introduce vulnerabilities in otherwise safe code: PoC.

In blocking mode it can be used as an side-channel oracle, leaking cross origin bodies/tokens: theory / PoC

Hot take, this is a terrible header that shouldn't be included. In this PR I explicit disable it, but this PR could also easily be refactored to completely remove the header.

Disabling it on modern browsers does nothing, as it is already disabled.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.