Add sandbox attribute to extension iframe in DevTools.

[johnpryan]

This change grants these permissions:

• allow-scripts: enables extension JS / Wasm execution.
• allow-forms: permits standard form interactions.
• allow-downloads: allows extensions to export files/logs.
• allow-popups & allow-popups-to-escape-sandbox: allows opening external links.

This does not grant allow-same-origin permission, so extensions can't access the parent window's DOM, cookies, or local storage.

[gemini-code-assist]

Code Review

This pull request introduces iframe sandboxing for embedded DevTools extensions to enforce origin isolation, and updates the release notes. The reviewer recommended extracting the raw sandbox configuration string into a descriptive named constant to avoid magic strings, in accordance with the repository style guide.

[srawlins]

Does this fix a specific issue that's been opened?

[johnpryan]

See b/535724008

[kenzieschmoll]

How was this tested? The iFrame does need to talk back and forth with the parent for the DevTools extension API, so just want to make sure everything here still works.

[johnpryan]

This should still allow postMessage communication with DevTools, but I only tested this with the foo_ext mock package, I will test this with a real-world package and let you know if anything stops working.

[johnpryan]

I ran a more complete test on the patrol package example and found that we needed to add the allow-same-origin header also.

These headers still prevent extensions from page-hijacking, displaying popups, etc, so this is still a good thing to do.