TinyMCE: improve the previews for embedded WordPress posts:

- Add option to force a sandbox iframe in wpview.
- Use it to show the embedded post preview.
- Remove the deprecated `wpembed` plugin.js

Fixes #39513.
Built from https://develop.svn.wordpress.org/trunk@40019


git-svn-id: http://core.svn.wordpress.org/trunk@39956 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-admin/includes/ajax-actions.php

@@ -3004,7 +3004,6 @@ function wp_ajax_parse_embed() {
 		$parsed = $styles . $html . $scripts;
 	}
 
-
 	if ( ! empty( $no_ssl_support ) || ( is_ssl() && ( preg_match( '%<(iframe|script|embed) [^>]*src="http://%', $parsed ) ||
 		preg_match( '%<link [^>]*href="http://%', $parsed ) ) ) ) {
 		// Admin is ssl and the embed is not. Iframes, scripts, and other "active content" will be blocked.
@@ -3014,10 +3013,23 @@ function wp_ajax_parse_embed() {
 		) );
 	}
 
-	wp_send_json_success( array(
+	$return = array(
 		'body' => $parsed,
 		'attr' => $wp_embed->last_attr
-	) );
+	);
+
+	if ( strpos( $parsed, 'class="wp-embedded-content' ) ) {
+		if ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) {
+			$script_src = includes_url( 'js/wp-embed.js' );
+		} else {
+			$script_src = includes_url( 'js/wp-embed.min.js' );
+		}
+
+		$return['head'] = '<script src="' . $script_src . '"></script>';
+		$return['sandbox'] = true;
+	}
+
+	wp_send_json_success( $return );
 }
 
 /**