main
fix(core): treat iframe credentialless as security-sensitive
fix(core): account for namespaces in host binding sanitization (#69558)
refactor: update license text to point to angular.dev (#57901)
fix(compiler): disallow translations of iframe src