Under the restriction of content security policy (CSP), you’re to come up with a solution that work around the CSP limitation and successfully run the Unity3d WebGL demo provided in an iframe.
This is the CSP. The CSP is fixed and changes to CSP is not negotiable.
The CSP is applied to an iframe. The demo is run within the iframe with no external files dependency.