Fixed deprecated feature policy header

[Eric-Wasson]

Fixed deprecated feature policy header and added some new permissions to deny that aren't needed.

Same change as the PR #1743 from the server repo.

[github-actions]

# npm audit report

@angular/common  20.0.0-next.0 - 20.3.13
Severity: high
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client - https://github.com/advisories/GHSA-58c5-g7wp-6w37
fix available via `npm audit fix`
node_modules/@angular/common
  @angular/forms  4.4.0-RC.0 - 4.4.0 || 20.0.0-next.0 - 20.3.13
  Depends on vulnerable versions of @angular/common
  Depends on vulnerable versions of @angular/platform-browser
  node_modules/@angular/forms
  @angular/platform-browser  20.0.0-next.0 - 20.3.13
  Depends on vulnerable versions of @angular/common
  node_modules/@angular/platform-browser
  @angular/platform-browser-dynamic  20.0.0-next.0 - 20.3.13
  Depends on vulnerable versions of @angular/common
  Depends on vulnerable versions of @angular/platform-browser
  node_modules/@angular/platform-browser-dynamic
  @angular/router  10.0.0-next.0 - 10.0.0-rc.1 || 20.0.0-next.0 - 20.3.13
  Depends on vulnerable versions of @angular/common
  Depends on vulnerable versions of @angular/platform-browser
  node_modules/@angular/router

body-parser  2.2.0
Severity: moderate
body-parser is vulnerable to denial of service when url encoding is used - https://github.com/advisories/GHSA-wqch-xfxh-vrr4
fix available via `npm audit fix`
node_modules/express/node_modules/body-parser

6 vulnerabilities (1 moderate, 5 high)

To address all issues, run:
  npm audit fix