XSS: allow iframe in popups

[nboisteault]

Allow iframe in popups but add sandbox="allow-scripts allow-forms" to avoid XSS

Funded by Valabre

[3liz-bot]

The backport to release_3_8 failed:

The process '/usr/bin/git' failed with exit code 1

stderr

error: could not apply 2ab2d2060... XSS: allow `iframe` in popups
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config advice.mergeConflict false"

stdout

Auto-merging tests/qgis-projects/tests/tests_dataset.sql
CONFLICT (content): Merge conflict in tests/qgis-projects/tests/tests_dataset.sql

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release_3_8 release_3_8
# Navigate to the new working tree
cd .worktrees/backport-release_3_8
# Create a new branch
git switch --create backport-4953-to-release_3_8
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick 2ab2d20602c76635bac511f3d9dab12f37ca6c35
# Push it to GitHub
git push --set-upstream origin backport-4953-to-release_3_8
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release_3_8

Then, create a pull request where the base branch is release_3_8 and the compare/head branch is backport-4953-to-release_3_8.

[josemvm]

@nboisteault thanks!