Fix checks to match with core handling for allowframeemedding

[keevan]

Upstream issue and PR:
h5p#424
h5p#425

https://github.com/moodle/moodle/blob/036800d99debfe61dde45f61292bc5ad44ab7cb0/lib/weblib.php#L2284-L2287
States that it only passes the 'X-Frame-Options: sameorigin' setting if embedding is disabled AND if the user is not loading the page from the app.

    // The Moodle app must be allowed to embed content always.
    if (empty($CFG->allowframembedding) && !core_useragent::is_moodle_app()) {
        @header('X-Frame-Options: sameorigin');
    }

Tested using the official Moodle app, pointing to a local instance