Disable default spring security headers, allow spring cloud gateway to manage them

[groldan]

This patch disables the Spring Boot default security headers in
org.georchestra.gateway.security.GatewaySecurityConfiguration.

The default Spring Boot security headers, and the Spring Cloud Gateway
security headers handling are two different things, and the former was
preventing the later from taking over the configuration.

The sample configuration in datadir/application.yaml disables x-frame-options and x-content-type options response headers.
It is a two step process, by one side, we need to remove the headers from downstream service responses,
by adding a RemoveResponseHeader default filter for each response header to remove.
On the other hand, the gateway's corresponding secure headers have to be disabled
(see spring.cloud.gateway.filter.secure-headers.disable.*)

For example:

spring:
  cloud:
    gateway:
      default-filters:
      - SecureHeaders # add security-related HTTP headers to responses sent from the gateway to clients. See https://blog.appcanary.com/2017/http-security-headers.html
      - TokenRelay # propagates OAuth2 access tokens from incoming requests to downstream services
      - RemoveSecurityHeaders # removing incoming sec-* headers to prevent impresionation
      - AddSecHeaders # append resolved sec-* headers to proxied requests based on the currently authenticated user
      - PreserveHostHeader # ensure that the original Host header from the incoming HTTP request is preserved and passed along to the downstream service
      - ApplicationError # use gateway's custom error pages when a downstream request returns an error code
      - LoginParamRedirect # redirect to /login if the request contains a ?login query param and is not already authenticated
      - RemoveResponseHeader=X-Content-Type-Options # remove unwanted response header from downstream services
      - RemoveResponseHeader=X-Frame-Options # remove unwanted response header from downstream services
      filter:
        secure-headers:
          enabled: true
          disable:
          # NOTE: header names must be lower-case
          - x-frame-options
          - x-content-type-options

[github-actions]

💔 All backports failed

Status	Branch	Result
❌	1.1.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

backport --pr 173

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details