Turn Allow frame embedding admin setting into a remote host whitelist

The admin Allow frame embedding is either on or off, but we'd like to be able to set policies like 'don't allow embedding generally but it's ok on these 5 domains' and have a textarea whitelist