Combining allow-scripts with allow-same-origin on a srcDoc iframe negates the sandbox; since the embedded HTML can come from LLM output or imported data, the iframe now runs in a null origin. postMessage control (targetOrigin='*') is unaffected. Adds a regression test. Fixes#725.
