Disable x-xss-protection as it's the defaults now

Both rails and secure header are now shipping with 0 by default.

See: https://www.github.com/github/secure_headers/issues/439

config/application.rb

@@ -118,9 +118,6 @@ class Application < Rails::Application
     # https://github.com/rails/rails/blob/d437ae311f1b9dc40b442e40eb602e020cec4e49/railties/lib/rails/application/configuration.rb#L92
     config.load_defaults 7.0
 
-    # TODO: this is the only change we had from defaults in 7.0.  See secure_headers.rb.  It's 0 in defaults.
-    config.action_dispatch.default_headers["X-XSS-Protection"] = "1; mode=block"
-
     # TODO: Find and fixed any deprecated behavior.  Opt in later.
     config.active_support.remove_deprecated_time_with_zone_name = false
     config.active_support.disable_to_s_conversion = false

config/initializers/secure_headers.rb

@@ -14,7 +14,9 @@
     #FYI, this was deprecated and disabled in rails 7.  Using content security policy is the desired behavior going forward:
     # https://github.com/rails/rails/commit/1f4714c3f798df227222f531141880b8e1b4170a
     # https://github.com/rails/rails/blob/d437ae311f1b9dc40b442e40eb602e020cec4e49/railties/lib/rails/application/configuration.rb#L227
-    config.x_xss_protection = "1; mode=block"
+    # Disable x-xss-protection as it's being dropped by other big stakeholders for legitimate security reasons:
+    # https://github.com/github/secure_headers/issues/439
+    config.x_xss_protection = "0"
     config.referrer_policy = "no-referrer-when-downgrade"
     # Content-Security-Policy
     # Need google fonts in fonts_src for https://fonts.googleapis.com/css?family=IBM+Plex+Sans+Condensed%7CIBM+Plex+Sans:400,600&display=swap (For carbon-charts download)