Implement custom rule for elements

[bolovsky]

we need to enforce element permission based on the available attributes, e.g., iframe whould only be allowed if the src matches a certain regex.