Merge pull request #195 from cloud-gov/2025-08-29_fix_contact_sandbox

chore(security): harden Airtable contact embed on /contact

Author: dandersonsw

src/pages/contact.astro

@@ -10,16 +10,31 @@ import sitewide from "../data/sitewide.yaml";
 
 <Layout title={content.title} description={content.description}>
   <Hero {...content.hero} />
-  <script src="https://static.airtable.com/js/embed/embed_snippet_v1.js"></script><iframe
+  <script src="https://static.airtable.com/js/embed/embed_snippet_v1.js"
+  ></script>
+  <iframe
+    title="Cloud.gov contact form (Airtable)"
     class="airtable-embed airtable-dynamic-height"
     src="https://airtable.com/embed/appbHJFEYs3H7fmA8/shrNrGC5KQnLgJqWc"
-    frameborder="0"
-    onmousewheel=""
+    loading="eager"
     width="100%"
     height="533"
-    style="background: url('./assets/img/loading.gif') no-repeat center 10% white; background-size: 10vw"></iframe>
+    referrerpolicy="origin"
+    sandbox="allow-forms allow-scripts allow-same-origin"
+    allow="
+    geolocation 'none';
+    camera 'none';
+    microphone 'none';
+    clipboard-read 'none';
+    clipboard-write 'none';
+    payment 'none';
+    usb 'none';
+    bluetooth 'none';
+    xr-spatial-tracking 'none'
+  "
+    onload="this.style.backgroundImage='none'"
+    style="border:0;background:#fff url('https://cloud.gov/assets/img/loading.gif') no-repeat center 10%;background-size:10vw"
+  ></iframe>
   <Tiles {...sitewide.supportTiles} />
   <Subscribe {...sitewide.newsletter} />
 </Layout>
-
-<style></style>