fix: allow cross-origin-isolation for the run endpoint

[SamVerschueren]

After digging into the issues with cross-origin-isolation and the run endpoint, I found out that the reason the run endpoint was not properly getting cross origin isolation because the iframe we created does not have a src property. This means that it renders this

<iframe allow="cross-origin-isolation"></iframe>

That iframe then posts to the /run endpoint. The problem is that the cross-origin-isolation is now allowing about:blank to be cross-origin isolated, not stackblitz.com. So in order to fix this, we have to set allow="cross-origin-isolation https://stackblitz.com" explicitly.

This PR also adds all the entire browser allow-list.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[Nemikolh]

Nice fix!!