Add x (formerly twitter) to allowed_hosts in media_embeddable.settings.yml

Problem/Motivation

When copying an embed code from X (formerly Twitter), the script tag defaults to:
<script async src="https://platform.x.com/widgets.js" charset="utf-8"></script>

When attempting to save this snippet using the Media Embeddable module, the application triggers a validation error stating that the domain is not allowed. However, if the source is manually changed back to the legacy domain (`https://platform.twitter.com/widgets.js`), it passes validation seamlessly.

The module's built-in filtering logic or default settings configuration needs an update to explicitly recognize `x.com` domains alongside legacy `twitter.com` domains.

Proposed resolution

Update the default allowed hosts configuration to support and whitelist `x.com` resource origins.