Iframes already provide that capability for web authors. Their sandbox and csp attributes allow you to enforce quite a lot of things.

Users or extension authors can't do much other than blocking those scripts or restricting what the whole page can do because it's difficult to attribute actions to a specific script.