Don't allow sandboxed iframes to set document.domain.

This is a recent spec change and makes us consistent with the mozilla
[See https://bugzilla.mozilla.org/show_bug.cgi?id=907892]

We add a new sandbox flag, although there isn't syntax to unset it as
part of the spec (yet).

BUG=277084

Review URL: https://codereview.chromium.org/86553003

git-svn-id: svn://svn.chromium.org/blink/trunk@162703 bbb929c8-8fbe-4397-9dbb-9b2b20218538