🛡️ Sentinel: [security improvement] Restrict iframe sandbox permissions

[ImChong]

This PR hardens the security of the embedded iframe (<iframe class="parkour-frame">) in the Demo.vue view by enforcing a stricter sandbox attribute.

As noted in the Sentinel learnings journal (.jules/sentinel.md), iframes without appropriate sandbox restrictions can inherit overly permissive capabilities. Previously, this iframe allowed forms (allow-forms) and modals (allow-modals), which are not required for its operation and violate the principle of least privilege.

By applying only allow-scripts allow-same-origin allow-downloads allow-popups, we maintain all required functionality while reducing the attack surface against unauthorized modal prompts or form submissions from untrusted or compromised iframe content.

• 🚨 Severity: LOW / MEDIUM (Defense in Depth)
• 💡 Vulnerability: Overly permissive iframe sandbox (allow-forms, allow-modals).
• 🎯 Impact: Embedded third-party or manipulated content could potentially present phishing forms or block the UI thread with modals.
• 🔧 Fix: Removed allow-forms and allow-modals from the iframe sandbox attribute in src/views/Demo.vue.
• ✅ Verification: Ran pnpm test and pnpm lint successfully. Verified that the embedded demo continues to load without needing these permissions.

---

PR created automatically by Jules for task 930048235890027267 started by @ImChong

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.