I was not able to implement back/forward as we have no way of interacting with history in a cross-origin iframe.

The URL input was also a problem because there is no way to know if the cross-origin iframe's URL changes (due to a link inside the iframe for example), so it risks becoming stale.

In the future we can maybe do something where we serve our own HTML that sets up a message channel with the parent to communicate history changes, and then it replaces itself with the real content (similar to weno), or alternatively we munge the original content and inject our message channel code directly into it, although this will only work for apps we ourselves serve, nothing externally hosted will work this way.

fixes#18178