When filling the iframe that's showing the preview for html requests, we
encode the html contents as a data-url and also set the sandbox property
on the frame. This avoids remaking the request from within devtools.
It's still possible for the iframe to spawn some requests. With this CL
we prevent requests by setting the csp for the iframe.
Bug: 833147
Change-Id: Id77321465c91fd68e5d6c6c3681e48b39cb32d14
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/3557989
Reviewed-by: Danil Somsikov <dsv@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
