The parent is jsut the domain name.
So for localhost the parent will be localhost you didn’t describe a URL you used for the iFrame. So not sure what you have done wrong.
Did you check the console?
This is a CSP Policy. And you only need to play with CSP if you are employing CSP so if this tag isn’t present then the default rules will apply. And what you have put is basically a default rule.
CSP should not be an issue here.