allow sandbox attribute to prevent external links from taking over the webview in hybrid apps

[t-var-s]

Expected Behavior

Possible external links offered by the vimeo iframe shouldn't be allowed to work in the context of a capacitor/cordova app.

Actual Behavior

Opening external links in the vimeo iframe takes over the parent webview. This has been previously reported in #1036

Steps to Reproduce

From the previous issue: "Use the player sdk to load a video in a cordova app. Click the vimeo icon or any other icon that opens an external url. It takes over the webview, effectively replacing the cordova app."

This is more a feature request than a bug report, although the current behavior results in blocking the app with the opened link. If it becomes possible to set the sandbox attribute for the iframe, we can knowingly control restrictions applied, even if those might break embedded features.