Disable cross-origin features on sandboxed pages

[devd]

If a top level document sandboxes itself using "CSP: sandbox" to sandbox itself, feature policy should treat it as a cross-origin document and disable any features that are disabled in cross origin frames.

This is based on w3c/payment-request#698 (comment) by @clelland I am not very familiar with this spec so apologies if I made a mistake in filing this issue.

[annevk]

This should fall out of HTML integration automatically. What's the status on that?

[clelland]

@marcoscaceres and I met today to discuss mechanisms to treat top-level documents as if they were untrusted cross-origin embeds, and have a concrete proposal to disable all (safe-to-disable) features by default, and allow individual ones to be overridden. See #189 (comment)