refactor: clean up iframe-fix.cjs code style and remove deprecated OpenClaw scope patch from start.sh

feat: enable iframe embedding by injecting a preload script to strip security headers and update CSP policies