I see that Drupal now automatically adds the 'X-Frame-Options: SAMEORIGIN' header. However, the client would like to give explicit permission to allow a
iframe embed to another site.
How do I allow iframe embeds to a particular domain?
If I'm understanding you correctly, this is actually an Apache setting. X-Frame-Options by default are SAMEORIGIN for security reasons. This option helps secure your site again various attacks.
To allow a specific domain to access your site (cross origin) you find the X-Frame-Options setting in your Apache configuration file and change it to say:
Header always append X-Frame-Options ALLOW-FROM=http://www.example.com
You will need access to the site server in order to do this. Also understand you will need to find the proper configuration file to add this to. Depending on the server setup this could be something different than the default httpd.conf or apache2.conf file.
you can set security level and also set exceptions