[FIX] Sanitize iframe src attribute's input

[d3xter666]

JIRA: CPOUI5FOUNDATION-728
fixes: https://github.com/SAP/ui5-server/security/code-scanning/4
fixes: https://github.com/SAP/ui5-server/security/code-scanning/3
Details: https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/

[coveralls]

coverage: 93.375% (-0.2%) from 93.586%
when pulling fbc75aa on fix-xss-in-dom
into ff1dc29 on main.

[flovogt]

LGTM. @codeworrior please have also a look at this one

[d3xter666]

Closing this one as we discussed in the meeting.

$iframe.attr is a jQuery/DOM API and it handles string escaping internally. So, this CodeQL alert is a false positive.

$frame.attr("src", "\"> <script>alert('test');</script><!--"); // Escaped and displayed properly in browser's console

$frame.attr("src"); // Getter. Returns: `"> \x3Cscript>alert('test');\x3C/script>\x3C!--`