I just hit this exact issue again today, this is something I would also like build.
In particular for internal Discourse instances there is zero reason to blacklist any sites. In general, I am not really sure what the value is of the whitelist approach. Facebook and Twitter seem to be coping just fine with a blacklist approach.
I guess the big question is:
What kind of abuse does the onebox whitelist only approach prevent? Honestly I am struggling really hard to think of any.