FXL: sandbox the iframes

fixed-layout.js

@@ -63,6 +63,9 @@ class Container {
             display: 'none',
             overflow: 'hidden',
         })
+        // `allow-scripts` is needed for events because of WebKit bug
+        // https://bugs.webkit.org/show_bug.cgi?id=218086
+        iframe.setAttribute('sandbox', 'allow-same-origin allow-scripts')
         iframe.setAttribute('scrolling', 'no')
         iframe.classList.add('filter')
         this.#element.append(element)