Add option to disable all secure headers

[elgamal-ahmed]

Adds disable: all support for the SecureHeaders filter so every secure header can be disabled without listing them individually.

This applies to both global configuration and route filter arguments. The setting also takes precedence over explicitly enabled optional headers, while preserving any headers already present on the response.

Fixes gh-2932.

[spencergibb]

Couldn't you just disable the filter?

[elgamal-ahmed]

Couldn't you just disable the filter?

Yeah, that's fair. The filter's opt-in, so if you're not using it there's nothing to disable anyway.

The scenario I had in mind is when SecureHeaders is set up as a default filter and you want it off for one environment or profile. You can do that with enabled: false, but that's a hard off since it drops the factory bean, so any route that still references SecureHeaders stops resolving. With disable: all the filter stays wired up and just doesn't add anything, so you can flip it in a single application-.yml without touching the filter list. It also won't quietly miss any new default headers that get added later, which was the main thing the original issue was asking for.

That said, your call. If you don't think it's worth the extra config, I'm fine closing it.

[spencergibb]

No, good point with default filters and then per route exceptions.