Use `iframe.contentWindow.frames.length` as an XS-Leak oracle

Original writeup (https://blog.pspaul.de/posts/facebook-ctf-2019-secret-note-keeper/).