Add optional CSP header to Editor iframe

Same as Shopify/shopify#25064

@angelini @qq99 for review