In tip#12, CSP blocks iFrame content

[pbosetti]

Perhaps I miss something, but the iFrame content is always blocked by content security policy, and I haven't found a way for fixing this.
Interestingly, I can't figure out why quarto.org is always allowed, wherever I publish the quarto document, but any other domain is blocked.