I would expect the generated <iframe> to have the `sandbox` attribute. However, this is not the case:
The attributes are put on the <body> of the contents of the iframe. This is expected behavior according to documentation, but from an API consumer/discovery perspective, this naming is confusing. `BodyAttributes` is more appropriate, though I wonder if it should be on `RichTextEditorIFrameSettings` at all.
How can I modify the attributes on an IFrame? This is very important for security reasons.