Add XSS guidelines to readme

As covered in VIP request #26661, adding [guidelines for iframe busters](https://gist.github.com/matthewspencer/3dcf48ffc2cb84b2ed52) to readme. cc @joshbetz