`<iframe>` `[allow]`: implement missing validation case

[kristoff-it]

In src/html/elements/iframe.zig we implement in validateAllow part of the syntax but we're missing the 'allow list' case, see relative TODO comment.

Relevant links:
https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element
https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow
https://w3c.github.io/webappsec-permissions-policy/#serialized-permissions-policy