discovery(nginx): security-headers (CSP, X-Frame, etc.) duplicated at 3+ locations in autobot-slm.conf.j2 — DRY via include snippet #6842

Context

Multiple location blocks in autobot-slm.conf.j2 repeat the same set of add_header lines:

• Line 44 (server-level default)
• Line 269 (Grafana fallback)
• Line 288 (Prometheus fallback)

Each block has CSP + X-Frame-Options + X-Content-Type-Options + X-XSS-Protection + Referrer-Policy. PR #6751 had to update CSP at all three sites; the next change will too.

Composable opportunity

# /etc/nginx/snippets/autobot-security-headers.conf
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; ..." always;

Each location: include /etc/nginx/snippets/autobot-security-headers.conf;

Constraint

CSP differs slightly per location (Grafana/Prometheus need 'unsafe-eval', blob:). Two snippets:

• autobot-security-headers-strict.conf (server default)
• autobot-security-headers-iframe-host.conf (Grafana, Prometheus)

Related

• discovery(nginx): CSP header missing on / and /login (only applies to /api/* routes) #6814 (CSP not applied to / and /login) — likely also fixed by this refactor since SPA location / would just include the snippet.

Acceptance

• Two snippet files deployed via Ansible (template task)
• All locations replaced with include directive
• CSP header observable on /, /login, /api/*, /grafana/, /prometheus/