[SPC] Fix createCredentialForAltDomain (#34508)

This was accidentally broken in 00f9369, but went unnoticed due to
issue #33690 . Fixing the method 'fixes' the test
authentication-cross-origin.sub.https.html, though it still fails due to
the underlying issue #33690

secure-payment-confirmation/utils.sub.js

@@ -64,7 +64,21 @@ async function createCredentialForAltDomain() {
   frame.src = 'https://{{hosts[alt][]}}:{{ports[https][0]}}' +
       '/secure-payment-confirmation/resources/iframe-enroll.html';
 
-  return new Promise(resolve => {
+  // Wait for the iframe to load.
+  const readyPromise = new Promise(resolve => {
+      window.addEventListener('message', function handler(evt) {
+        if (evt.source === frame.contentWindow && evt.data.type == 'loaded') {
+          window.removeEventListener('message', handler);
+
+          resolve(evt.data);
+        }
+      });
+  });
+  document.body.appendChild(frame);
+  await readyPromise;
+
+  // Setup the result promise, and then trigger credential creation.
+  const resultPromise = new Promise(resolve => {
       window.addEventListener('message', function handler(evt) {
         if (evt.source === frame.contentWindow) {
           document.body.removeChild(frame);
@@ -73,8 +87,9 @@ async function createCredentialForAltDomain() {
           resolve(evt.data);
         }
       });
-      document.body.appendChild(frame);
   });
+  frame.contentWindow.postMessage({ userActivation: true }, '*');
+  return resultPromise;
 }
 
 function arrayBufferToString(buffer) {