Add "disableSecurity" option to InfoBox

See this thread: https://groups.google.com/d/msg/cesium-dev/Ktn8aPQmOsQ/_Dbd7igkCQAJ

While we expose the ability to disable iframe sandboxing, some use cases need the title text to be HTML as well, which is currently using the knockout `text` binding instead of HTML. This will also help with the fact that most people aren't familiar with iframe sandboxing and we can provide them a single top-level property for disabling it.

This should be a simple change in InfoBox.js, see the above thread for some more details.

Start with InfoBox.js to trace the current title binding and iframe sandboxing option, then read the linked Cesium developer thread for the intended behavior. Done means the InfoBox exposes the requested top-level disableSecurity option and supports HTML title text without breaking the existing behavior.

Written by the indexing model from the issue text.