fix: address demo mock review

packages/widgets/src/iframe/component.spec.ts

@@ -21,6 +21,8 @@ describe("iframe policy", () => {
   it("accepts HTTP URLs and same-origin paths", () => {
     expect(isSupportedProtocol("https://example.com")).toBe(true);
     expect(isSupportedProtocol("/api/demo-assets/overview")).toBe(true);
+    expect(isSupportedProtocol("//evil.example")).toBe(false);
+    expect(isSupportedProtocol("/\\evil.example")).toBe(false);
     expect(isSupportedProtocol("javascript:alert(1)")).toBe(false);
     expect(isSupportedProtocol("not a url")).toBe(false);
   });