Bugzilla

The console records the reason that we reject fullscreen request:
> Request for fullscreen was denied because at least one of the document’s containing elements is not an iframe or does not have an “allowfullscreen” attribute.

And indeed the video is from an `<iframe>` without `allowfullscreen`:
```html
<iframe title="This impressive sculpture is made out of 100,000 knives collected by the police" width="100%" height="100%" frameborder="0"></iframe>
```

I checked the Fullscreen spec, and found that there is something new since we implemented the strategy, specifically the [Feature Policy Integration](https://fullscreen.spec.whatwg.org/#feature-policy-integration), which indicates that when `allowfullscreen` is not set, "its default allowlist is 'self'". And based on the [Feature Policy](https://w3c.github.io/webappsec-feature-policy/#default-allowlists) document, `'self'` means same-origin child document is allowed, which seems to be the case here.

So my assumption is that we need to implement the feature policy integration for Fullscreen API in order to have this work.

Since Feature Policy seems to belong to DOM: Security component, I'm moving it there.

The console records the reason that we reject fullscreen request:
> Request for fullscreen was denied because at least one of the document’s containing elements is not an iframe or does not have an “allowfullscreen” attribute.

And indeed the video is from an `<iframe>` without `allowfullscreen`:
```html
<iframe width="100%" height="100%" frameborder="0"></iframe>
```

I checked the Fullscreen spec, and found that there is something new since we implemented the strategy, specifically the [Feature Policy Integration](https://fullscreen.spec.whatwg.org/#feature-policy-integration), which indicates that when `allowfullscreen` is not set, "its default allowlist is 'self'". And based on the [Feature Policy](https://w3c.github.io/webappsec-feature-policy/#default-allowlists) document, `'self'` means same-origin child document is allowed, which seems to be the case here.

So my assumption is that we need to implement the feature policy integration for Fullscreen API in order to have this work.

Since Feature Policy seems to belong to DOM: Security component, I'm moving it there.