Allow auto-discovered embeds to link to third party sites.

[peterwilsoncc]

In r34903 for #32522 WordPress introduced support for auto-discovery of oEmbeds.

As part of this, links within the embedded content were limited to only allow them to be directed to the source origin. Eg, make.wordpress.org embeds may only link to URLs on make.wordpress.org.

This has the effect of requiring that any social type embed be added to the allow list if they systematically include links to third party sites. See my comment on the Gravatar allow list request, #62467 (comment).

I'd like to remove this limitation for a couple of reasons:

• it requires providers be added to the allow list that wouldn't otherwise need to be
• it's relatively easy to work around with an open redirect (validated with a salted checksum, for preference)

Links are currently limited to the http and https protocols. This limitation ought to be retained.