improve documentation for nextcloud security

The default configuration does not pass security checks.
A change to ssl.conf is required for secure operation.
This behaviour can be very confusing to new users.
Documenting this should help make it easier for
new nextcloud users to have a secure experience.

nextcloud.subdomain.conf.sample

@@ -32,6 +32,7 @@ server {
         set $upstream_proto https;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
 
+        # Uncomment X-Frame-Options directive in ssl.conf to pass security checks.
         proxy_hide_header X-Frame-Options;
         proxy_max_temp_file_size 2048m;
     }