Add local-fonts to the allowlist

[jakub-nlx]

Is your feature request related to a problem? Please describe.
I am trying to build a font-picker that can return accurate font data about locally installed fonts. There is a web api window.queryLocalFonts, that helps to do this.

Describe the solution you'd like
It needs the local-fonts permission, which needs to be explicitly listed on the iframe that actually runs user code. So I'd like the local-fonts permission to be added to the iframe.

Describe alternatives you've considered
Giving up 🤷