fix(browser): drop --disable-web-security from default Chrome flags

[route]

Fixes #472.

--disable-web-security was one of Ferrum's default Chrome flags, so every page ran without the same-origin policy. That's fine for test suites, but tools that load untrusted pages (screenshots, scraping) let those pages read other origins. Chrome 155 already blocks the file:// iframe from the issue, about:blank#blocked, even with the flag set, but cross-origin reads still go through.

The flag is no longer a default. Cuprite adds it itself, so Capybara suites keep their current behavior (companion change in rubycdp/cuprite, release both together). Anyone who needs the old behavior can pass browser_options: { "disable-web-security" => nil }.

Behavior change: Frame#frame_element reads window.frameElement, which the same-origin policy hides from a cross-origin frame, so it returns nil for one now. The YARD comment and docs/15-frames.md say so.

Specs:

• A new spec checks that a cross-origin fetch from 127.0.0.1 to localhost is blocked by default. It fails with the old defaults.
• The #frame_element example moves to the same-origin /frame_parent fixture, since /frames loads its iframes from localhost while the page is on 127.0.0.1. A new example checks that /frames returns nil for a cross-origin frame.
• supports :ignore_default_browser_options argument used to remove disable-web-security by name and never checked anything. It now leaves out mute-audio and checks the launch command: the dropped default is gone, the passed flag and the required --remote-debugging-port/--user-data-dir flags are there.

Full suite: 629 examples, 0 failures. Cuprite against this branch with the flag added: 1855 examples, 0 failures.