This moves preview rendering to an iframe with a document loaded
cross-origin as a source. This enforces cross-origin separation and
gives the preview window it's own localstorage, isolated from the parent.

Content is injected into the doc via `postMessage`.

This prevents the project HTML etc. being sent before the renderer
has initialised, which was resulting in the the message being missed
and the Run button appearing to do nothing when initially clicked.