Open Redirect / XSS via iframe with sandbox.

## Summary
This is similar issue to #959, but different cause.
Due to `sandbox` attribute is allowed, attacker can redirect victim to something malicious if attacker embeds iframe with `allow-top-navigation` in `sandbox` attribute.
#959 won't work in Chrome because of their security, but this will work due to `sandbox` is whitelist attribute.
This will be XSS in Safari by using data scheme.
## Step to reproduce
1. Type `````` in Editor. (It doesn't work because my domain is expired.)
2. View edited page.

[PoC](https://demo.codimd.org/YcIX0oKzQAuZMMOqxeASdg)
(This PoC will redirect you to [example.com](https://example.com))

## CVE
[CVE-2019-15499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15499)

## Suggested fix
Don't allow `sandbox` attribute in public/js/render.js.