Update X-XSS-Protection to current recommendation

See:

- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection and
- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection

core/nginx/conf/nginx.conf

@@ -117,7 +117,7 @@ http {
       add_header X-Frame-Options 'SAMEORIGIN';
       add_header X-Content-Type-Options 'nosniff';
       add_header X-Permitted-Cross-Domain-Policies 'none';
-      add_header X-XSS-Protection '1; mode=block';
+      add_header X-XSS-Protection '0';
       add_header Referrer-Policy 'same-origin';
 
       # mozilla autoconfiguration