The app-wide CSP already blocks inline script execution, but the HTML
preview iframe for a stored email was same-origin and un-sandboxed, and
the html_raw response had no per-action hardening. Add a sandbox on the
iframe and tighten the CSP on html_raw to script-src 'none' with
nosniff and no-referrer so the preview has defence in depth against a
future CSP bypass or regression.
Relates to GHSA-f6g9-8555-cw28.
* Update mysql2 query call to cast booleans
* Treat messages:held field as boolean
* Treat messages:inspected field as boolean
* Treat messages:spam field as boolean
* Treat messages:threat field as boolean
* Treat messages:bounce field as boolean
* Treat messages:received_with_ssl field as boolean
* Treat deliveries:sent_with_ssl field as boolean
