Add sandbox attribute to Customizer preview iframe to prevent top-navigation

[westonruter]

We go through some hoops to prevent a script in the Customizer preview from attempting to set the top window. For example: ​https://github.com/WordPress/wordpress-develop/blob/2ddcc54/src/wp-includes/js/customize-preview.js#L381-L384

The iframe element in HTML5 supports a sandbox attribute which we can use to prevent the window from changing the loaded top window.

See ​https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

[valchovski]

Hi, added the sandbox attribute excluding the top navigation token.

Removed the previous hack for preventing links from breaking out of the preview

[pento]

In 44583:

Customizer: Use the sandbox attribute to prevent top navigation from the preview.

Props valchovski.
Fixes #42341.