feat(external-api) sandbox the iframe

Give it the minimum amount of permissions necessary to run.

modules/API/external/external_api.js

@@ -392,6 +392,7 @@ export default class JitsiMeetExternalAPI extends EventEmitter {
         this._frame.name = frameName;
         this._frame.id = frameName;
         this._setSize(height, width);
+        this._frame.sandbox = 'allow-scripts allow-same-origin';
         this._frame.setAttribute('allowFullScreen', 'true');
         this._frame.style.border = 0;