[CORS-RFC1918] Test inheritance for sandboxed iframes.

We test 6 out of the 7 possible URLs:

 - about:blank
 - the initial empty doc
 - about:srcodc
 - data:
 - blob:
 - filesystem:

We do not test javascript:, since we cannot load in a sandboxed iframe
(even with `sandbox = "allow-scripts"`).

Fixed: chromium:1167697
Change-Id: I8c4c634bd7c0cc7d1ed9a6c1148f63fa79f7dfcb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2637616
Auto-Submit: Titouan Rigoudy <titouan@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Commit-Queue: Titouan Rigoudy <titouan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#844765}

content/browser/renderer_host/render_frame_host_impl.h

@@ -2725,6 +2725,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // WARNING: This does not behave exactly as specified in HTML. Instead it more
   // closely follows the Blink implementation, which predates it, for
   // consistency.
+  //
+  // TODO(https://crbug.com/1168024): Fix this to behave as specified in HTML.
   bool is_web_secure_context_ = false;
 
   network::CrossOriginEmbedderPolicy cross_origin_embedder_policy_;