feat: add csp headers for embedded apps (#18374)

I modified the proxy host cache we already had and were using for
websocket csp headers to also include the wildcard app host, then used
those for frame-src policies.

I did not add frame-ancestors, since if I understand correctly, those
would go on the app, and this middleware does not come into play there.
Maybe we will want to add it on workspace apps like we do with cors, if
we find apps are setting it to `none` or something.

Closes https://github.com/coder/internal/issues/684

coderd/proxyhealth/proxyhealth.go

@@ -0,0 +1,8 @@
+package proxyhealth
+
+type ProxyHost struct {
+	// Host is the root host of the proxy.
+	Host string
+	// AppHost is the wildcard host where apps are hosted.
+	AppHost string
+}