chore(security): harden Airtable contact embed on /contact

[wz-gsa]

Changes proposed in this pull request:

• Replace raw Airtable iframe with a secured embed:
  • sandbox="allow-forms allow-scripts" (isolate third-party content)
  • referrerpolicy="origin" (Airtable sees only https://cloud.gov as referrer)
  • Deny powerful features via iframe allow (permissions policy)
  • Preserve loading.gif UX (cleared on onload)

security considerations

• sandbox isolates the embed and enables only what a form needs (forms + scripts).
• The iframe allow attribute further restricts powerful features (Permissions Policy) on top of any page-level policy.
• referrerpolicy="origin" lets Airtable confirm traffic origin (e.g., https://cloud.gov) without leaking paths/params

[dandersonsw]

LGTM