feat: allow user to add an allow list (#12236)

libs/src/LSPlugin.caller.ts

@@ -275,6 +275,7 @@ class LSPluginCaller extends EventEmitter {
       url: url.href,
       classListArray: ['lsp-iframe-sandbox'],
       model: { baseInfo: JSON.parse(JSON.stringify(pl.toJSON())) },
+      allow: pl.options.allow,
     })
 
     let handshake = pt.sendHandshake()

libs/src/LSPlugin.core.ts

@@ -161,6 +161,7 @@ interface PluginLocalOptions {
   settings?: PluginSettings
   effect?: boolean
   theme?: boolean
+  allow?: string
 
   [key: string]: any
 }

libs/src/postmate/index.ts

@@ -288,7 +288,8 @@ export type PostMateOptions = {
   id?: string
   classListArray?: Array<string>
   name?: string
-  model?: any
+  model?: any,
+  allow?: string
 }
 
 /**
@@ -315,6 +316,7 @@ export class Postmate {
     this.frame = document.createElement('iframe')
     if (opts.id) this.frame.id = opts.id
     if (opts.name) this.frame.name = opts.name
+    if (opts.allow) this.frame.allow = opts.allow
     this.frame.classList.add.apply(
       this.frame.classList,
       opts.classListArray || []