FEATURE: Additional control of iframes in oneboxes (PR #10523)

This commit adds a new site setting “allowed_onebox_iframes”. By default, all onebox iframes are allowed. When the list of domains is restricted, Onebox will automatically skip engines which require those domains, and use a fallback engine.

(For this draft, the Gemfile is updated to use the Onebox branch. Before merging, the Onebox gem will be bumped and the Gemfile updated to match)