Sandbox the iframe. (#64)

This isn't particularly effective with the demo that loads the local
simulator as it's the same origin but useful for copy/paste of this code
with a real deployment URL.

Author: microbit-matt-hillsdon

src/demo.html

@@ -72,6 +72,7 @@ <h1>MicroPython-micro:bit simulator example embedding</h1>
             title="Simulator"
             frameborder="0"
             scrolling="no"
+            sandbox="allow-scripts allow-same-origin"
           ></iframe>
           <div id="sensors" class="column"></div>
         </div>