Add disableAvm flag, which turns off both AVM1 and AVM2.

This is extremely useful for anyone who wants to host and display a SWF on their site, but does not know or does not trust the author of the SWF.

Adding `disableAvm: true` to the `SWF.embed()` options allows SWFs to render and play, but without executing any of the code inside (which could potentially be malicious).