[Spec] Add sandbox attribute + handling

[blu25]

This CL does the following:

• Specs out the "sandbox" attribute in the fencedframe element.
• Specs out the fencedframe sandboxing flag set to match the iframe equivalent.
• Specs out the behavior that ensures that a fenced frame's active sandboxing flag set is at least as restrictive as the fenced frame config's effective sandboxing flags.
• Specs out the behavior that a fenced frame cannot load if the final sandboxing flag set is more restrictive than the effective sandboxing flags.

Follow-up PRs will need to be done for the following:

• Setting the effective sandboxing flags for config-generating APIs in their respective repos.
• Setting the effective sandboxing flags for the default constructor case. See: [Spec] Navigating from the default FencedFrameConfig(url) constructor doesn't install a fenced frame config. #178
• Fixing the numberings for the navigate patches, as the algorithm has changed significantly since we last monkey patched it. See: [Spec] Fix the navigation patch numberings + patches #179

See issue: #155

---

Preview | Diff

[domfarolino]

Looking pretty good.

[domfarolino]

Pretty much lgtm % one comment about what looks like a stray random line of text