Block the HTTP proxy path in subframes

Editor assessment

This commit patches CVE-2026-103922. A second subframe variant with the same precise subject and no body. The header is correct, the target is well identified, and there is no stylistic noise. What is absent is the attack model - what an embedded frame could reach through the proxy path - and where the check now runs. Thin but valid; a short body would raise it. Formally valid with a specific target; no body follows, so the message reads as a headline rather than an explanation. The subframe wording is specific; adding which proxy endpoint or platform API is guarded would make the fix checkable.