fix(iframe.xss.response.js): Allow JSON with more than one level

The original regex used to parse the response in an iframe in IE9 and younger
was not producing  valid JSON for responses with at least
two levels of nesting.

The matching code has also been refactored out into a separate function,
`readIframeResponse` to help with testability. The code to send the postMessage
to the parent window is still located within a self-executing anonymous func.

Fixes #913
test(iframe.xss.response.js): Test readIframeResponse

refers to #913
refactor(iframe.xss.response.js): Parse inside anonymous function.

References: #913
test(iframe.xss.response.js): Proper tests

Actually tests iframe postMessage and receive message events along
with the new iframe.xss.response parsing code.

References: #913
fix(test/unit/iframe.xss.response.js): Change path to script

The injected script's (`iframe.xss.response.js`) path was incorrect
when using the `grunt connect:test_server` which was leading to failures
on the unit tests on travis.

ref: #913
fix(test/unit/iframe.xss.response.js): Fix path to script

Karma puts scripts into a './base' folder
Merge branch 'feature/iecors-deep-json' into develop