fix: allow js scipts for most https origin

[bytecii]

Description

Sometimes eigent generates the interactive htmls but cannot render / interact usually because of we now only allow one javascript script (js from https://cdn.amplitude.com).

Now add as many as https allowlist as possible

Fixes #1233

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

[nitpicker55555]

can we remove allow-same-origin? When an iframe enables both allow-scripts and allow-same-origin, and uses srcDoc (thus sharing the same origin as the parent page), scripts inside the frame effectively gain the same privileges as the main application — allowing them to access the parent DOM, read sensitive data, and even remove the sandbox, rendering the isolation meaningless from a security perspective. check https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

[bytecii]

If we removed that, many demo examples will not be correctly shown.

[Wendong-Fan]

would using blob URL instead of srcDoc could resolve this issue?

[Wendong-Fan]

For this trade-off, the most efficient approach seems to be simply removing allow-same-origin. It’s mainly used for localStorage, which isn’t typically required for 3D rendering. What do you think?
@bytecii

[Wendong-Fan]

thanks @bytecii , I will remove allow-same-origin for now and merge this PR to move things forward first, if we have better solution we can add another enhance PR later