To embed a workspace app in an iframe, Coder has to use a frame-src CSP header that allows embedding from the workspace app's domain. In dev.coder.com we set that header manually, but we need to solve that in Coder itself before we release Tasks.

Part of the solution was already merged, but we also need support for apps running in subdomains.