Iframes already provide that capability for web authors. Their sandbox and csp attributes allow you to enforce quite a lot of things. Users or extension author

Iframes already provide that capability for web authors. Their sandbox and csp attributes allow you to enforce quite a lot of things. Users or extension authors can't do much other than blocking those scripts or restricting what the whole page can do because it's difficult to attribute actions to a specific script.