Stop altering existing Permissions-Policy header in FinishResponseSubscriber

Problem/Motivation

Non-core service definitions are loaded after core's, which will cause module event subscribers with the same priority to execute later. As a result, core will:
(1) In normal cases likely never execute the line of code to append to an existing Permissions-Policy header
(2) Always have its header value overwritten by any other implementation

The results in a section of code that is normally unreachable, but with the potential for unexpected behaviour in non-typical circumstances.

Steps to reproduce

- Add the Permissions Policy module to a site
- In the module's configuration, enable the 'Enforced' policy and a directive (e.g. set geolocation to 'empty')
- Inspect the headers of a response

Because the module's subscriber has the same priority as core's subscriber (both use the default of 0), its value completely replaces the core value.

Proposed resolution

Core should only set a default value if a Permissions-Policy header is not already set, and not attempt to modify any existing value.

Remaining tasks

None

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet