Educate users on HTTP security headers

[jportner]

In #52809 (PR: #97158) we introduced configuration properties for security response headers:

• server.securityResponseHeaders.strictTransportSecurity, default: null (not enabled) ❌
• server.securityResponseHeaders.xContentTypeOptions, default: 'nosniff' (enabled) ✅
• server.securityResponseHeaders.referrerPolicy, default: 'no-referrer-when-downgrade' (enabled) ✅
• server.securityResponseHeaders.permissionsPolicy, default: null (not enabled) ❔
• server.securityResponseHeaders.disableEmbedding, default: false (not enabled, embedding is allowed) ❌

Out of these, it would be good to change the default for strictTransportSecurity and disableEmbedding. I propose the following:

• strictTransportSecurity: max-age 31536000; includeSubDomains
  • This has the potential to break other sites when Kibana is hosted via HTTPS on a domain, and other websites are hosted HTTP-only on the same domain (or subdomains). In that case, users will be unable to access the HTTP-only websites after receiving this header from Kibana. If this did occur, end-users can clear their browser settings for HSTS, but at this point in time it is not clear how to do so when you encounter an error.
• disableEmbedding: true
  • This has the potential to break Kibana usage when Kibana is being embedded in other pages -- it would prevent Kibana from functioning when embedded in a different website. We do not yet have usage data to estimate how many users this will impact.

At this point in time, permissionsPolicy is not yet implemented in most browsers, and the features that it can control do not appear to be well-defined. We may want to revisit this in the future when the benefits are clearer.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jportner]

Changing the default headers is potentially too disruptive for users, and we don't have a great way to display useful errors / help users fix these problems in failure scenarios.

A better alternative would be to display a prominent warning in a Security Checkup screen and tell them to set these headers.