Fix handling of security.headers.* to allow headers to be disabled

Spring Security 4’s default configuration will, irrespective of any
other header writers that are added, enable writers for the following
headers:

 - X-Content-Type
 - X-XSS-Protection
 - Cache-Control
 - X-Frame-Options

Previously, SecurityProperties.headers used false as the default for the
properties that enable or disable these headers but the configuration is
only applied when the properties are true. This left us with the right
default behaviour (the headers are enabled) but meant that the
properties could not be used to switch off the headers.

This commit changes the defaults for the four properties to true and
updates SpringBootWebSecurityConfiguration to only apply the
configuration when the properties are false. This leaves us with the
desired defaults while allowing users to disable one or more of the
properties by setting the relevant property to false.

Closes gh-3517

spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc

@@ -303,10 +303,10 @@ content into your application; rather pick only the properties that you need.
 	security.basic.path= # /**
 	security.basic.authorize-mode= # ROLE, AUTHENTICATED, NONE
 	security.filter-order=0
-	security.headers.xss=false
-	security.headers.cache=false
-	security.headers.frame=false
-	security.headers.content-type=false
+	security.headers.xss=true
+	security.headers.cache=true
+	security.headers.frame=true
+	security.headers.content-type=true
 	security.headers.hsts=all # none / domain / all
 	security.sessions=stateless # always / never / if_required / stateless
 	security.ignored= # Comma-separated list of paths to exclude from the default secured paths