Add setting to allow add additional schemes to the local origin security setting

This PR add a setting that allow us to add new schemes to the QWebSecurityOrigin class. A case when this is useful is when I try to run some javascript code to access the data in a iframe loaded from a different domain (with the default settings this is not allowed).

I think it is safe to leave this setting enabled by default (as opposed to in a browser), since the code is run in the Splash server and not in the client code (and we are trusting implicitly the client JS code anyway).