Add permissions policy integration

[marcoscaceres]

The spec is currently somewhat unclear about the role of iframe and how web monetization works with third-party contexts.

It should be possible for embedded iframes to be monetized, but also restriction monetization to first-party iframes. Then we can just use permissions policy to enable payments for third-parties.

In other words/html:

<iframe allow="monetization" src="https://remote.com"></iframe>

[marcoscaceres]

Note that this might also be a breaking change. Are we allowing monetization by default in third-party iframes? That seems somewhat risky, as it means that embedded third party content could start collecting money unbeknownst to the first party origin.