ALLOW-ALL option is too permissive, should be configurable

Thanks for your request and your code contribution ehossack.
Updating ticket so the community help us testing it.

Hi @ehossack, I was testing the new feature, and it looks great, but I have a few suggestions:

1. The field 'allowed-embedding-substr' should be a textarea, for the cases where we need to have more than one path.
2. Using str_contains to check the path might lead to allow a whole group of pages that we might not want, for example if we configure /blog, it will also allow all the blog articles that have the URL like /blog/article1 and /blog/article2. I understand that in your case you will have all the pages with the path /embedded, but for other sites that might be different. We could think of accepting tokens like and *.

What do you think?