I believe the problem occurs because the regex for these sites in the antisamy/high-security-policy.xml whitelist is using delimited trailing forward slashes
removing the delimited trailing forward slashes appears to fix the problem (could possibly just remove the delimiter, but I believe removing both works as well.
h5p, sharestream, kaltura antisamy whitelists aren't working
even though those sites are added to the antisamy/high-security-policy.xml whitelist, embedding their embed codes in e.g. lessons does not work
Actually, I could not test sharestream because I don't have an account with them, but it appears as though it would be affected by the bug as well.
it fails on https://trunk-mysql.nightly.sakaiproject.org/