Harden embed preview iframe with sandbox restrictions

[aashu2006]

Changes:
Adds sandbox restrictions to the embed/standalone preview iframe to align its behavior with the existing IDE preview security model.

This is a minimal, non-functional hardening change; normal sketches continue to run as expected, while previously unrestricted behaviors are constrained.

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #123
• meets the standards outlined in the accessibility guidelines

[welcome]

🎉 Thanks for opening this pull request! Please check out our contributing guidelines if you haven't already.

[aashu2006]

FYI this mirrors the sandbox configuration already used in the IDE preview.