WIP: load VM in <iframe sandbox="allow-scripts">

This is a work-in-progress that loads the VM in an iframe with `sandbox="allow-scripts"` so it can compile Java code to JavaScript (#405) on device.

It introduces a wrapper.html page that loads index.html in an iframe, forwarding URL parameters. It also proxies access to mozContacts. It doesn't yet handle mozTCPSocket and mozMobileConnections.

I haven't yet tested this on device, and there's this interesting message in the Web Console on desktop:

> An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing.