Move to <iframe> providers

What does this MR do and why?

This rewrites the frontend and backend to use the <iframe> providers framework, introduced in the first three MRs of this stack. After this MR is merged, the <iframe> transform framework is dead code; we drop it in the next MR in the series. (Trying very hard to keep each MR to ~500 lines changed or less!)

The feature is behind a wip-type default-disabled FF, which is disabled in all GitLab.com environments. This is not a breaking change.

Before this MR, the <iframe> embed feature used an application setting where an admin could permit arbitrary domains, without any ability to specify per-domain settings, permit only specific URLs under those domains, etc. The provider model was developed in concert with AppSec and addresses the concerns of the legacy design; after this MR, the application setting controls which providers are enabled, and the provider config is consulted and used to determine the final embed URL, as well as the sandbox configuration for any given embed. The source URL is revalidated on the frontend against the recognised provider before the inert <img> is finally transformed into an <iframe>.

Duo had some comments but the reply to all is "addressed in a stacked MR".

MR stack

MR 4/10 of Rework <iframe> embed configuration (#599713):

1. Add `<iframe>` provider model and parser (!254943 - merged)
2. Add `<iframe>` provider loader and base config (!254944 - merged)
3. Convert `<iframe>` allowlist setting to provide... (!254945 - merged)
4. Move to `<iframe>` providers (!254946) ⬅️ you are here
5. Draft: Remove dead `<iframe>` transform code (!254947)
6. Draft: Allow additional CSP hosts in iframe embeds (!257463)
7. Draft: Frontend `<iframe>` hardening (!254948)
8. Draft: Click-to-activate functionality for `<if... (!254949)
9. Draft: Admin UI for `<iframe>` providers (!254950)
10. Draft: Mark `<iframe>` provider loader and conf... (!255246)

Part of <iframe> embeds in Markdown content (#282443).

How to test locally

1. Enable the allow_iframes_in_markdown FF.
2. Navigate to Admin -> Settings -> General -> Embedded content.
3. Check "Enable embedded content", and in the "Allowed domains" list, type just "youtube", and then click "Save changes".
   • This is the old admin UI; it'll get updated to checkboxes for each possible provider in Draft: Admin UI for `<iframe>` providers (!254950)!
   • It should look like this:
     
4. Navigate to a work item, MR, or wiki page.
5. Using the plain-text editor, enter the following text:

   ![](https://youtu.be/edCMWv6Xeuo){width=500 height=300}

6. Save.
7. You should see this:
   
8. Click the "play" button.
9. Watch the video.
10. You may laugh, if you like. This video's 16 years old!
11. Confirm the sandbox on the YouTube <iframe> in the inspector:
    
    It's the same as in config/iframe_providers.yml's youtube.sandbox.
12. Edit the field and switch to the rich-text editor. The embed should look OK, and if you edit its source, it should show the original youtu.be URL.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.