Google had just recently enabled this feature. It has been under a ‘feature request’ status for quite a long time. Link here
You can now explicitly define X-Frame-Options.
To allow embedding under another domain, the option should be HtmlService.XFrameOptionsMode.ALLOWALL
Google documentation on the subject:
Example:
function doGet() {
return HtmlService.createTemplateFromFile('form.html')
.evaluate() // evaluate MUST come before setting the Sandbox mode
.setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);
}
Hope this helps!