There's no really good way to do this. The problem is less clickjacking - though that is a risk - and more that the user has no way to know whether the frame is genuine, or a phishing site. Anybody who wants to can put up an iframe that looks like yours, and just steals the user's credentials for your site if anybody thinks that this might be a real instance ...
If you control the system
Besides cached files that you see there can be other places where browser data can be found:
System swap file
Temporary files (this is not the same as cache)
Data in the deleted (some files can be restored after deletion)
That's why, if you have some sensitive data in cached files, caring about cache files only is not sufficient.
Is it safe to allow passing the [script URL] as a URL query param?
No, this is very dangerous. See question #3.
If this code is an issue, what are the specific attacks that could happen here?
Since an attacker could pass any script into the URL, and have it run in your sites origin, you are basically opening yourself up to XSS attacks. That is very bad.
A (specific) : I'm not getting the same results as you are. I can take the session and AUTH cookies, and re-use them in a terminal window to curl for the Conversations JSON payload (among others).
I can even remove the cookie called Session-ID and it still works. I will note that I deleted the header called x-pm-uid and the subsequent request failed. Maybe ...
This is my own code, and I trust it as far as not having malicious code in it.
This is just an assumption. As long as this assumption is not enforced it can not be relied on. The current proposal allows to load script from arbitrary URL into your page, i.e. completely out of your control. This allows for an XSS attack.
To secure this you need to make sure ...
Your question is very specific to the usage of 'Instagram Basic Display API(Long live access token)' which is not just limited to display/access public information of a profile.
You can perform Refresh Access Tokens everyday which leads to DOS attack. (User node and Media node can be accessed only with latest access token). Exceeding Rate limit also leads to ...