refactor: add clickjacking protection headers

[DevipriyaS17]

Summary
This PR address by adding anti-clickjacking response headers to Console HTTP responses. The change prevents the Console UI and API endpoints from being embedded in third-party frames, reducing risk of UI redress attacks against authenticated sessions.

Issue:
The finding states Console is vulnerable to clickjacking.

Sample Output

1. Authorize endpoint headers

curl --noproxy '*' -k -s -o /dev/null -D - -X POST 'https://127.0.0.1:8181/api/v1/authorize' \
  -H 'Content-Type: application/json' \
  -d "{\"username\":\"$USERNAME\",\"password\":\"$PASSWORD\"}" \
  | grep -Ei '^(HTTP/|x-frame-options:|content-security-policy:)'


HTTP/2 200
content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN

2. Protected GET headers

curl --noproxy '*' -k -s -o /dev/null -D - 'https://127.0.0.1:8181/api/v1/server/features' \
  -H "Authorization: Bearer $TOKEN" \
  | grep -Ei '^(HTTP/|x-frame-options:|content-security-policy:)'


HTTP/2 200
content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN

3. Protected POST headers

PROFILE="cjtest$(date +%s)"
curl --noproxy '*' -k -s -o /dev/null -D - -X POST 'https://127.0.0.1:8181/api/v1/admin/ieee8021xconfigs' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"profileName\":\"$PROFILE\",\"authenticationProtocol\":0,\"pxeTimeout\":0,\"wiredInterface\":false,\"version\":\"\"}" \
  | grep -Ei '^(HTTP/|x-frame-options:|content-security-policy:)'

HTTP/2 201
content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.26%. Comparing base (1068b27) to head (11a050c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1195      +/-   ##
==========================================
+ Coverage   49.79%   50.26%   +0.47%     
==========================================
  Files         146      146              
  Lines       13460    13466       +6     
==========================================
+ Hits         6702     6769      +67     
+ Misses       6177     6108      -69     
- Partials      581      589       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds global anti-clickjacking response headers to Console’s Gin HTTP router to prevent UI/API embedding in third-party frames.

Changes:

• Introduced a Gin middleware that sets X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' on responses.
• Added unit tests asserting these headers are present both for a simple route and for the /api/v1/authorize route.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/controller/httpapi/router.go	Adds clickjacking protection middleware and applies it globally to the router.
internal/controller/httpapi/ui_test.go	Adds tests validating the middleware and router behavior sets the expected headers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[sudhir-intc]

In addition to the review comments provided, please update the postman collections too with the expected responses.

[sudhir-intc]

The current approach adds these headers for container and headless deployments as well. I recommend limiting them to the standalone Console build with the embedded UI, since container/headless deployments expose only REST APIs and do not serve browser-rendered content where clickjacking or browser capability policies apply.
Consider making the browser security-header behavior runtime-configurable to allow deployment-specific customization.

@rsdmike / @MadhaviLosetty : Do you agree on this ?