fix incorrect frame-ancestors and update test

lib/defaults.js

@@ -32,7 +32,7 @@ Default.commonCSP = function (Env) {
         "media-src blob:",
 
         // for accounts.cryptpad.fr authentication and cross-domain iframe sandbox
-        Env.enableEmbedding?  "frame-ancestors *": `frame-ancestors ${domain}${sandbox}`,
+        Env.enableEmbedding?  `frame-ancestors 'self' ${Env.protocol}`: `frame-ancestors ${domain}${sandbox}`,
         "worker-src 'self'",
         ""
     ];

lib/env.js

@@ -68,6 +68,8 @@ module.exports.create = function (config) {
     }
 
     const Env = {
+        protocol: new URL(httpUnsafeOrigin).protocol,
+
         fileHost: config.fileHost, // XXX
         NO_SANDBOX: NO_SANDBOX,
         httpSafePort: httpSafePort,

www/checkup/main.js

@@ -990,7 +990,7 @@ define([
 
                 'img-src': ["'self'", 'data:', 'blob:', $outer],
                 'media-src': ['blob:'],
-                'frame-ancestors': ApiConfig.enableEmbedding? ['*']: [$outer, $sandbox],
+                'frame-ancestors': ApiConfig.enableEmbedding? ["'self'", window.location.protocol]: [$outer, $sandbox],
                 'worker-src': ["'self'"],
             });
             cb(result);
@@ -1028,7 +1028,7 @@ define([
                 ],
                 'img-src': ["'self'", 'data:', 'blob:', $outer],
                 'media-src': ['blob:'],
-                'frame-ancestors': ApiConfig.enableEmbedding? ['*']: [$outer, $sandbox],
+                'frame-ancestors': ApiConfig.enableEmbedding? ["'self'", window.location.protocol]: [$outer, $sandbox],
                 'worker-src': ["'self'"],//, $outer, $sandbox],
             });