[Docs Bug] Header advice wrong

[annevk]

In w3c/webappsec#520 @Malvoz pointed me to https://webhint.io/docs/user-guide/hints/hint-no-html-only-headers/ which states that certain headers only apply to HTML content. Most if not all of these are relevant to XML. And Content-Security-Policy is also relevant to workers, which use a JavaScript MIME type (typically).

X-Frame-Options might be relevant to any response really.

[antross]

@annevk thanks for pointing this out!

XML definitely should be included in the documentation; webhint's CLI already treats XML with the same rules as HTML for this hint.

The worker case is also interesting and not currently covered. I agree webhint should allow this, though if possible still flag the headers when a script is being used somewhere other than a worker. I'll open a separate issue to track updating the implementation.

Now that I'm looking I also see some of the outdated, experimental headers listed here should probably move to webhint's Disallowed HTTP Headers as they should really no longer be used regardless of resource type (e.g. X-WebKit-CSP). I'll open a separate issue for this too.