adding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox w

adding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox without allow-same-origin puts it into a null origin which makes the iframe isolated from all other origins which is similar to an ephemeral container. It might break CORS stuff though.