Add allowScriptAccess opt and default to sameDomain

Found a potential security issue related to the `<embed>` params for the SWF, which were hard-coded with `allowScriptAccess` set to `always`. This would allow a SWF file hosted externally to gain access to the HTML, which can lead to potential cross-site scripting vulnerabilities if the SWF file is under someone else's control. Adobe recommends that this options be set to `sameDomain` by default.

I added an option so that users can override the default of `sameDomain` if they like. If a user is loading the SWF from a different domain than the hosting page, then problems could occur with the functionality of ZeroClipboard.

More info on the `allowScriptAccess` param here:
* http://helpx.adobe.com/flash/kb/control-access-scripts-host-web.html

Appreciate your feedback. I ran the tests and they all passed. Let me know if I missed anything or made any mistakes.

Best,
Mani