Which HTTP header helps prevent Cross-Site Scripting (XSS) and other code injection attacks by restricting resources the browser is allowed to load?