Use sandbox attribute to prevent fenced scripts from running on same-origin

To improve security, we should use the iframe [sandbox](https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#attr-sandbox) attribute to limit the context of the iframe contents and its scripts and prevent them from running on the same-origin as the parent page, which currently allows it access to the whole page, cookies, etc.

See http://output.jsbin.com/bikucu/1 for an example of restrictions in different contexts of iframes.

This introduces complications as fence can no longer peak into and modify the contents of the iframe to normalise it (remove inner margin and paddings) and to resize the iframe element based on the dimensions of its contents. The solution would be to inject some script (inline or loaded from a CDN via a `` tag) that would do the normalisation and monitor the document height, posting resizing requests using `postMessage`, which fence would have to listen to from outside and use to resize the iframe element.

See [iframe-wrapper](https://github.com/guardian/interactive-boot-scripts/blob/master/iframe-wrapper/boot.js) and [iframe-messenger](https://github.com/guardian/iframe-messenger) for a working example of how that can be done.

cc @adamnfish @oliverjash @sihil