Drop dead X-Frame-Options rules from the haproxy edge (#487)

The 13 `X-Frame-Options DENY if acl_<host>` rules in `fe_https` have never fired:
their ACLs use `req.hdr(host)`, a request-direction fetch that is invalid in a
response ruleset, so HAProxy rejects them at config-check time. Carried over
verbatim from the Puppet LXD config during the k8s move.

- Remove the 13 dead `http-response set-header X-Frame-Options` rules.
- Remove the 15 now-orphaned `acl acl_*` definition lines.

Not switching the header on: it has never been live, and Grafana/Gitea send their
own. `haproxy -c` warnings drop 33 -> 20; the two working response headers stay.

Reviewed-on: #487
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/haproxy/configmap.yaml

@@ -94,36 +94,8 @@ data:
       mode http
       description Global HTTPS Frontend
       acl acl-letsencrypt path_beg /.well-known/acme-challenge/
-      acl acl_sonarr req.hdr(host) -i sonarr.main.unkin.net
-      acl acl_radarr req.hdr(host) -i radarr.main.unkin.net
-      acl acl_lidarr req.hdr(host) -i lidarr.main.unkin.net
-      acl acl_readarr req.hdr(host) -i readarr.main.unkin.net
-      acl acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net
-      acl acl_nzbget req.hdr(host) -i nzbget.main.unkin.net
-      acl acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net
-      acl acl_fafflix req.hdr(host) -i fafflix.unkin.net
-      acl acl_gitea req.hdr(host) -i git.unkin.net
-      acl acl_grafana req.hdr(host) -i grafana.unkin.net
-      acl acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net
-      acl acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net
-      acl acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net
-      acl acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net
-      acl acl_kanidm req.hdr(host) -i auth.unkin.net
       http-request set-header X-Forwarded-Proto https
       http-request set-header X-Real-IP %[src]
-      http-response set-header X-Frame-Options DENY if acl_sonarr
-      http-response set-header X-Frame-Options DENY if acl_radarr
-      http-response set-header X-Frame-Options DENY if acl_lidarr
-      http-response set-header X-Frame-Options DENY if acl_readarr
-      http-response set-header X-Frame-Options DENY if acl_prowlarr
-      http-response set-header X-Frame-Options DENY if acl_nzbget
-      http-response set-header X-Frame-Options DENY if acl_jellyfin
-      http-response set-header X-Frame-Options DENY if acl_fafflix
-      http-response set-header X-Frame-Options DENY if acl_gitea
-      http-response set-header X-Frame-Options DENY if acl_grafana
-      http-response set-header X-Frame-Options DENY if acl_ceph_dashboard
-      http-response set-header X-Frame-Options DENY if acl_stalwart_webadmin
-      http-response set-header X-Frame-Options DENY if acl_kanidm
       http-response set-header X-Content-Type-Options nosniff
       http-response set-header X-XSS-Protection 1;mode=block
       use_backend be_letsencrypt if acl-letsencrypt