requesting slightly more verbose docs for gatsby-plugin-netlify's `mergeSecurityHeaders` setting

Summary

It was not obvious from reading https://www.gatsbyjs.org/packages/gatsby-plugin-netlify/ (particularly the configuration section that the mergeSecurityHeaders set the following header rules widely:

    `X-Frame-Options: DENY`,
    `X-XSS-Protection: 1; mode=block`,
    `X-Content-Type-Options: nosniff`,
    `Referrer-Policy: same-origin`

using MergeSecurityHeaders: false does indeed disable them. Could we get an explicit mention of what those headers are in the docs, which currently gloss over it? I will be happy to create a PR if that is preferred, though I am not sure of the best place to say it. By default I’d probably create a comment block like this, right in the middle of the configuration section, but I am not the best docs writer! Something like this:

// mergeSecurityHeaders: true will set the following:
//     `X-Frame-Options: DENY`,
//    `X-XSS-Protection: 1; mode=block`,
//    `X-Content-Type-Options: nosniff`,
//   `Referrer-Policy: same-origin`

Motivation

This is opaque and can lead to CORS errors with common workflows such as embedding youtube videos in your gatsby pages.

Steps to resolve this issue

I don’t propose a behavior change, just some clarity on what that feature does without reading the source code or trying to reverse engineer a deployed netlify site by looking at HTTP response headers in the browser and thinking “I didn’t set those…how are they there?”

Please let me know if a PR would be appropriate and I will happily open one following either the above plan or your guidance!

[LekoArts]

cc @gatsbyjs/learning

[pieh]

We have couple of plugins that document options in different ways:

• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-contentful/README.md#configuration-options
• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-wordpress/README.md#how-to-use
• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-remark-images/README.md#options

It would be nice to come around at consistent way of documenting options (and defaults). I think that adding comments to gatsby-config.js example (like in gatsby-source-wordpress README) is least readable way and would like either nested headers (like in gatsby-source-contentful README or table (like in gatsby-remark-images README).

The documentation change to add more clarity to plugin options is always welcome, let’s just figure out nicest way to do it and hopefully that would be “go to” way to do this.