Create iframe before Penpal connects

Since Penpal 3.1 it's possible to provide an iframe element to Penpal instead of Penpal creating it itself. The documentation recommends doing this when a sandbox attribute is set on the iframe, which is done for UI extensions.

After CMS-11796 we should indeed create an iframe element with a sandbox attribute ourselves and let Penpal use it.