Security: sandbox iframes, add rel to abs anchors
Security: sandbox iframes, add rel to abs anchors

This is a pre-emptive measure: there is not an actual vulnerability that I am aware of.

1. Add a sandbox to all `<iframe>`s. The sandbox is very permissive, but still better than no sandbox.
2. Add `rel="noopener nofollow"`, the former is to prevent a certain kind of phishing attacks, and the latter discourage spammers.

Also, removed the excessive `merge` calls. `Sanitize::Config.merge` is a deep merge already.

techAPJ/onebox,discourse/onebox,techAPJ/onebox,discourse/onebox,techAPJ/onebox