edge浏览器无法显示iframe中的内容，x-frame-option一直为deny

Jmix
#1

在Chrome中是可以正常显示iFrame和iFrame中的PDF文件的，只有在Edge浏览器和火狐浏览器无法显示。
我在控制器中给iframe的src进行赋值，赋值方式为：

String hostAddress = InetAddress.getLocalHost().getHostAddress();
String url = "http://" + hostAddress + ":8080/rest/files?fileRef=" + weeklyMst.getWeeklyFile().toString();
weeklyPDFIframe.setSrc(url);

我也照着样例创建了configure类

@Configuration
@EnableWebSecurity
public class EwRestSecurityConfiguration extends FlowuiVaadinWebSecurity {
    @Bean
    @Order(JmixSecurityFilterChainOrder.FLOWUI - 10)
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        String hostAddress = InetAddress.getLocalHost().getHostAddress();
        http.securityMatcher("/rest/files/**")
                .authorizeHttpRequests((authorize) -> authorize.requestMatchers("/rest/files/**").permitAll());
        http.headers(headers ->
                headers.contentSecurityPolicy(secPolicy ->
                        secPolicy.policyDirectives("frame-ancestors " + hostAddress + ":8080")
                )
        );
        return http.build();
    }
}

但是在访问后，X-Frame-Option的值依旧是DENY

#2

我这里是基于组件化开发，这个配置类需要添加在可运行项目中。