Allow embedding on a limited set of referrers

**Why is this needed**: Currently, you can set allow_embedding to `true` to remove the `X-Frame-Options: deny` header so that Grafana dashboards can be embedded. However, this has the limitation of removing a useful clickjacking mitigation. Lifting the embed restriction only for certain referrers would allow for embedding when the location doing the embedding is trusted while still providing broader mitigation against clickjacking. **What would you like to be added**: It would be great to have a new option (or further flexibility for the existing allow_embedding option) such that `X-Frame-Options: deny` is conditionally provided depending on where the request originates from. For example, I may want to allow embedding a public dashboard hosted on grafana.example.com on an internal administration interface hosted on admin.example.com. This could also be achieved by allowing configuration of the Content-Security-Policy frame-ancestors directive. I could do this myself by putting Grafana behind a separate reverse proxy, but it would simplify ensuring a secure setup by allowing this to be configurable within Grafana directly. **Who is this feature for?** This is intended for users who want to allow public embedding (particularly for public dashboards) in other parts of their internal systems without removing the entire security mitigation for clickjacking. This issue is a followon to #76780 which I inadvertently allowed to go stale