feat(jsinput): Allow JSInput problems to create downloads
A small fix for a small issue.
We're getting around the limitation right now by having everyone right-click, open in new tab, and then download the resulting PDF, but it would be nice to not deal with this limitation in the future.
Given that the pages iframed into JSInput problems are always controlled by partners, typically hosted in Files & Uploads, and have access only to the current user's data, the additional security risk from adding "allow-downloads" to the sandbox list feels minimal.
Sandbox attributes are not passed from the `<jsinput>` tag to the iframe, so the change can't be made on a problem-by-problem basis.