Add patch to make iframe sandboxed by default.

iframes are now sandboxed by default except for following cases:

1. host is localhost.
2. scheme is other than http and file.
3. nested iframes (e.g. iframes in iframe).
Add patch to disable sandbox in SharedWorker.