[FR] add iFrame allow to CodeSandbox extension

🌈 Feature

Please make the browser preview behave more like a full browser by removing X-Frame options, which blocks working on Oauth/SAML and other federated features.

https://codesandbox.io/s/builtin-browser-bug-y02x9?file=/src/index.ts

Before Removing X-Frame-options:

There is an extension that already does it here:
https://chrome.google.com/webstore/detail/iframe-allow/gifgpciglhhpmeefjdmlpboipkibhbjg

But its security is bit lax. The CSB extension should only do it within the embedded browser preview or only on our Sandboxes.

For linkedIn and youtube you'll might also have to remove the CSP frameblock.
Refused to frame 'https://accounts.youtube.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://accounts.google.com".

After you install an Allow iFrame extension that removes X-Frame-options... which is what I'm proposing the CSB browser extension to do for iFrame document requests made inside the Sandbox browser:

Start with the CodeSandbox example at codesandbox.io/s/builtin-browser-bug-y02x9 and its referenced src/index.ts, then locate the browser preview and extension entry points in this repository. Review how iframe document requests are handled and define the restriction to embedded previews or CodeSandbox Sandboxes. Done means OAuth/SAML and other federated previews work while unrelated browsing remains protected, including the noted CSP cases.