Add ability to disable or filter object embed - admin / settings

[Sing-Li]

Object embed is a source of bots-net styled Denial of Service attacks for chat based systems

For the admin / settings page, it would be nice to have:

1. setting to disable embed altogether
2. setting to replace iFramely oembed with simple-embed (we may not have access to item 3 with iFramely)
3. setting to configure [access, deny] filter rules for "after embed transforms", "before render", URLs

item 3 is likely a pre-requisite for corporate installs

[engelgabriel]

See #230

[engelgabriel]

Depends on #222