Group wiki issue with mermaid in iframe

There's an issue with !74414 (merged) that doesn't seem to be covered in #346441 (closed) or #349602 (closed). In a group wiki the iframe for mermaid is being denied. I see this in the console log and the mermaid load is denied in the Chrome dev tools "Network" tab. It seems like lib/gitlab/content_security_policy/config_loader.rb should cover this but maybe not for group wikis for some reason?

Refused to display 'https://gitlab.titanhq.com/' in a frame because it set 'X-Frame-Options' to 'deny'.