docs: address code review comments

- Fix test count in SECURITY_AUDIT.md (11 tests, not 24)
- Add deprecation note for ALLOW-FROM in X-Frame-Options
- Update documentation to recommend CSP frame-ancestors instead

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_security_headers.py

@@ -141,6 +141,7 @@ def test_x_frame_options_valid_value(client):
     if "X-Frame-Options" in response.headers:
         x_frame_value = response.headers["X-Frame-Options"]
         valid_values = ["DENY", "SAMEORIGIN"]
+        # Note: ALLOW-FROM is deprecated in modern browsers; use CSP frame-ancestors instead
         assert x_frame_value in valid_values or x_frame_value.startswith(
             "ALLOW-FROM"
         ), f"Invalid X-Frame-Options value: {x_frame_value}"