feat: add security properties for iFrame

[Skaiir]

Closes #901

[vsgoulart]

@Skaiir Didn't @volodymyr-melnykc ask for the show security attributes toggle to be removed?

[vsgoulart]

@Skaiir everything looks fine to me, we just need to check the previous comment I made about the toggle

[Skaiir]

@Skaiir Didn't @volodymyr-melnykc ask for the show security attributes toggle to be removed?

Yeah the PR was made before those comments, sorting this out now.

[Skaiir]

Made some adjustments. I'm still a bit apprehensive with regards to this configuration here (ignore validation error).

This is an XSS attack surface, because if you've got allow-scripts and allow-same-origin that's the equivalent of the iframe basically not being a sandbox anymore, and yeah if there's malicious scripts it can elevate its own priviledges to doing everything, plus it has access to the session cookies, which means it can escalate into session hijacking.

Okay after some heavy reading I'm a little reassured. So, allow-same-origin only really de-sanboxes if the parent and iframe are on the same domain. This would mean that for an XSS attack to occur, it would require something on whatever js embedding domain to already be vulnerable to script injection. Anyways, I am going to rename allow-same-origin's user text from 'Storage and Cookies' to 'Allow same origin'. Because right now it gives the impression that you can't use basic website functionality without this set, which is not true. That way nobody will assume what it does and will have to read into it.

[vsgoulart]

LGTM