Add documentation for the markdown.allowiframe setting

Change-Id: I50263027f42d00c4316b0aa003d00e53ac44d0c3

Documentation/config.md

diff --git a/Documentation/config.md b/Documentation/config.md
index 9a99ced..65feff2 100644
--- a/Documentation/config.md
+++ b/Documentation/config.md
@@ -52,6 +52,36 @@
   imageLimit = 256K
 ```
 
+### IFrames
+
+IFrame source URLs can be whitelisted by providing a list of allowed
+URLs. URLs ending with a `/` are treated as prefixes, allowing any source
+URL beginning with that prefix.
+
+```
+[markdown]
+  allowiframe = https://google.com/
+```
+
+URLs not ending with a `/` are treated as exact matches, and only those
+source URLs will be allowed.
+
+
+```
+[markdown]
+  allowiframe = https://example.com
+  allowiframe = https://example.org
+```
+
+If the list has a single entry with the value `true`, all source URLs
+will be allowed.
+
+
+```
+[markdown]
+  allowiframe = true
+```
+
 ## Google Analytics
 
 [Google Analytics](https://www.google.com/analytics/) can be

Documentation/markdown.md

diff --git a/Documentation/markdown.md b/Documentation/markdown.md
index fdd34a9..baf728f 100644
--- a/Documentation/markdown.md
+++ b/Documentation/markdown.md
@@ -619,7 +619,8 @@
 _(optional)_
 
 Embedded source URLs must also be whitelisted by the Gitiles
-`markdown.allowiframe` configuration variable.
+[`markdown.allowiframe`](/Documentation/config.md#IFrames) configuration
+variable.
 
 ## Site layout