I have noticed the following errors in the browser console:

[Violation] Potential permissions policy violation: fullscreen is not allowed in this document.
[Violation] Potential permissions policy violation: xr-spatial-tracking is not allowed in this document.

They appear not just with rawgit but also when running the demo locally (with HTTPS). It seems it's possible to prevent them locally by adding this line when creating the iFrame.

iframe.allow = 'fullscreen;xr-spatial-tracking';

I wonder why they appear in the first place. Does the browser analyze the JS and realize the engine could make use of WebXR?

I wonder why they appear in the first place. Does the browser analyze the JS and realize the engine could make use of WebXR?

I believe it's caused by the fact that the Three.js examples page tries to allow the inner iframe both fullscreen and xr-spatial-tracking (examples/index.html#L41). But in this example, it itself is in an iframe that isn't allowed these permissions, so it can't pass these on or grant them.