Make `security.promptForPromptProtocolHandling` a real setting and an allow list

[bpasero]

I would think that security.promptForPromptProtocolHandling could be a real setting so that a user can edit decisions made at a later point easily. I would make that setting a string[] being the allow list of hosts to are allowed without prompt.