Allow expanding variables in amp-iframe src URL

### Description

There are a couple of places where variables like `CANONICAL_URL` are expanded automatically (form inputs, URL in `amp-consent`, variables in `amp-analytics`, etc.). But it is not possible to pass variables to the `amp-iframe`'s src URL. Is there a reason that this is not the case? Or was there just no need for it so far?

I planned to implement it, but faced a few questions:

- Implement it for `amp-iframe` v0.1 or v1.0 or both?
- The `AmpIframe.transformSrc_` function (assuming v0.1 is fine) is a perfect place to put the call to `Services.urlReplacementsForDoc`. But it is sync. Is it okay to use `expandUrlSync` and miss the async variables for now? Or shall the whole init code of `amp-iframe` be changed into async so `expandUrlAsync` could be used?
- Some variables that should be blacklisted/whitelisted?

### Alternatives Considered

I don't really see an alternative for e.g. passing canonical URL to an iframe other than having support for variables.

### Additional Context

_No response_