Add <iframe> provider loader and base config

What does this MR do and why?

This adds the iframe provider loader, and the base config, per https://gitlab.com/gitlab-com/gl-security/product-security/appsec/appsec-reviews/-/work_items/326#note_3306214369 (staff-only). This has no consumers yet.

MR stack

MR 2/9 of Rework <iframe> embed configuration (#599713):

1. Add `<iframe>` provider model and parser (!254943 - merged)
2. Add `<iframe>` provider loader and base config (!254944 - merged) ⬅️ you are here
3. Convert `<iframe>` allowlist setting to provide... (!254945)
4. Draft: Move to `<iframe>` providers (!254946)
5. Draft: Remove dead `<iframe>` transform code (!254947)
6. Draft: Frontend `<iframe>` hardening (!254948)
7. Draft: Click-to-activate functionality for `<if... (!254949)
8. Draft: Admin UI for `<iframe>` providers (!254950)
9. Draft: Mark `<iframe>` provider loader and conf... (!255246)

Part of <iframe> embeds in Markdown content (#282443).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.