use regex for iframe installer origin whitelist

Better (assuming you do this for allizom too of course), but I'm still worried about whitelisting too much. I'm especially worried about app:// origins, because you can easily use app://localhost or app://dummy.firefox.com and I'm not sure that would be spotted by reviewers.

We could forbid using <anyprotocol>://localhost and <anythingwithfirefox/allizominit> or as origin in Marketplace but still I think I'd sleep better if we'd just be more restrictive in this whitelist...