Form page CSP sandboxing now toggleable via env var

Form pages in n8n—used by Form Trigger, Send and Wait, and related nodes—have been protected by Content Security Policy sandbox headers that restrict what browsers can do with rendered form content. For some deployments, particularly those behind reverse proxies with their own header handling, this sandboxing has caused conflicts. A new environment variable, N8N_INSECURE_DISABLE_FORM_HTML_SANDBOX, allows administrators to disable these CSP headers entirely. When set to true, the sandbox headers are not applied to form page responses. The default remains false, preserving the current secure behavior for new installations. The code carries an explicit warning: disabling CSP protection leaves instances vulnerable to workflows that could make requests using other users' credentials. The recommended mitigation is serving forms from a separate subdomain, not disabling the sandbox—but when that is not feasible, this escape hatch exists. This change applies to form rendering across the CLI and nodes-base packages, unifying CSP handling that previously differed between webhook and form pages.