[Spec] Add sandbox attribute + handling

This CL does the following:

Specs out the "sandbox" attribute in the fencedframe element.
Specs out the fencedframe sandboxing flag set to match the iframe equivalent.
Specs out the behavior that ensures that a fenced frame's active sandboxing flag set is at least as restrictive as the fenced frame config's effective sandboxing flags.
Specs out the behavior that a fenced frame cannot load if the final sandboxing flag set is more restrictive than the effective sandboxing flags.

Follow-up PRs will need to be done for the following:

Setting the effective sandboxing flags for config-generating APIs in their respective repos.
Setting the effective sandboxing flags for the default constructor case. See: https://github.com/WICG/fenced-frame/issues/178
Fixing the numberings for the navigate patches, as the algorithm has changed significantly since we last monkey patched it. See: https://github.com/WICG/fenced-frame/issues/179

WICG / fenced-frame