fix(core): iframe rendering issue for youtube videos (#12880)

#### PR Dependency Tree


* **PR #12880** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Bug Fixes**
- Improved iframe preview behavior for code blocks, enabling enhanced
compatibility and resource access within previews.
- **Chores**
- Updated internal server configuration to no longer set custom
cross-origin headers during development.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts

@@ -67,11 +67,6 @@ export class HTMLPreview extends SignalWatcher(WithDisposable(LitElement)) {
   override firstUpdated(_changedProperties: PropertyValues): void {
     const result = super.firstUpdated(_changedProperties);
 
-    if (!window.crossOriginIsolated) {
-      this.state = 'fallback';
-      return;
-    }
-
     this._link();
 
     this.disposables.add(

packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts

@@ -3,5 +3,5 @@ import type { CodeBlockModel } from '@blocksuite/affine/model';
 export function linkIframe(iframe: HTMLIFrameElement, model: CodeBlockModel) {
   const html = model.props.text.toString();
   iframe.srcdoc = html;
-  iframe.sandbox.add('allow-scripts');
+  iframe.sandbox.add('allow-scripts', 'allow-same-origin');
 }

tools/cli/src/bundle.ts

@@ -125,20 +125,6 @@ const defaultDevServerConfig: DevServerConfiguration = {
       },
     ],
   },
-  headers: (req): Record<string, string | string[]> => {
-    if (
-      [/^\/api/, /^\/socket\.io/, /^\/graphql/].some(path =>
-        path.test(req.path)
-      )
-    ) {
-      return {};
-    }
-
-    return {
-      'Cross-Origin-Opener-Policy': 'same-origin',
-      'Cross-Origin-Embedder-Policy': 'require-corp',
-    };
-  },
   proxy: [
     {
       context: '/api',