[SECURITY-2559] Stored XSS vulnerability iframeportlet [SECURITY-2565] add sandbox attribute per default empty with system properties to disable and/or add attribute content

[olamy]

integrate back fixes from security branch

Signed-off-by: Olivier Lamy olamy@apache.org

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[daniel-beck]

FTR as a side effect, https://github.com/jenkinsci/dashboard-view-plugin/tree/dashboard-view-2.19 is not on the history of the default branch, something to be mindful of when git bisecting etc.