My nginx fu is weak, but here’s a copy/pasta from the W.org config that may help:

map $upstream_http_x_wp_embed $allow_embed_iframes {
default ‘SAMEORIGIN’;
true ”;
}