new security rule: iframe has invalid or missing sandbox attribute

[HamletDRC]

• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

• https://cwe.mitre.org/data/definitions/915.html

• From WEB1088 ModernCop IframeHasInvalidSandboxAttribute WEB

  The <Iframe> tag has a missing or invalid sandbox attribute value. The <iframe> tag should have a 'sandbox' attribute set with at least one valid option ('allow-forms', 'allow-same-origin', 'allow-scripts', or 'allow-top-navigation').? Setting both 'allow-scripts' and 'allow-same-origin' for a single <iframe> tag is not advised.