Add sandbox attribute to extension iframe in DevTools. (#9967)

* Add sandbox attribute to extension iframe in DevTools.

This change grants these permissions:
- `allow-scripts`: enables extension JS / Wasm execution.
- `allow-forms`: permits standard form interactions.
- `allow-downloads`: allows extensions to export files/logs.
- `allow-popups` & `allow-popups-to-escape-sandbox`: allows opening
   external links.

This does not grant `allow-same-origin` permission, so extensions can't
access the parent window's DOM, cookies, or local storage.

* Add pull request URL

* Move string to top-level variable

* Add allow-same-origin to DevTools extension iframe sandbox

Flutter Web extensions require same-origin access for flutter.js to
initialize Service Workers and web storage without throwing a
SecurityError.

This is still secure because the extension must be enabled, and
the sandbox prevents top-level navigation, popups, and modal hijacking.

* Add a timestamp to the extension placeholder

This is to ensure "force reload extension" works.

* Update extension debugging skill

* Revert "Update extension debugging skill"

This reverts commit 4cebdf8cb158d1f8b15e86cd1c5ced930ec75eee.

* Specify permissions for iframe in comment

* Revert "Add a timestamp to the extension placeholder"

This reverts commit 177df19436b9d0face3d23c2c5d15cf25c37940a.