Include Cross-Origin-Opener-Policy in default response headers

[thomheymann]

Part of #141780

Release notes

Include Cross-Origin-Opener-Policy in default response headers

Testing

Load Kibana; you should see Kibana respond with Cross-Origin-Opener-Policy: same-origin header for page loads and API requests.

[github-actions]

Documentation preview:

• ✨ Changed pages

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 6889218

Metrics [docs]

Unknown metric groups

ESLint disabled in files

id	before	after	diff
osquery	1	2	+1

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
fleet	61	67	+6
osquery	109	115	+6
securitySolution	439	445	+6
total			+20

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
fleet	70	76	+6
osquery	110	117	+7
securitySolution	515	521	+6
total			+21

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jbudz]

kibana-docker

[pgayvallet]

LGTM.

Just a remark though, I'm surprised we don't have any FTR test suite for that area/feature. I feel like having only unit tests (especially kinda low in the chain) may not necessarily be sufficient for things like testing response headers?

[thomheymann]

I feel like having only unit tests (especially kinda low in the chain) may not necessarily be sufficient for things like testing response headers?

There's already integration tests for response headers here: src/core/server/integration_tests/http/lifecycle_handlers.test.ts