Draft: Allow additional CSP hosts in iframe embeds

What does this MR do and why?

Allow additional CSP hosts in iframe embeds

Figma requires redirecting through www.figma.com; it's why the old domain instructions required allowlisting "embed.figma.com" and "www.figma.com" separately.

Permit this in provider config.

MR stack

MR 6/10 of Rework <iframe> embed configuration (#599713):

1. Add `<iframe>` provider model and parser (!254943 - merged)
2. Add `<iframe>` provider loader and base config (!254944 - merged)
3. Convert `<iframe>` allowlist setting to provide... (!254945 - merged)
4. Move to `<iframe>` providers (!254946)
5. Draft: Remove dead `<iframe>` transform code (!254947)
6. Draft: Allow additional CSP hosts in iframe embeds (!257463) ⬅️ you are here
7. Draft: Frontend `<iframe>` hardening (!254948)
8. Draft: Click-to-activate functionality for `<if... (!254949)
9. Draft: Admin UI for `<iframe>` providers (!254950)
10. Draft: Mark `<iframe>` provider loader and conf... (!255246)

Part of <iframe> embeds in Markdown content (#282443).

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.