I have following config in my antisamy policy file:
Old YouTube Object:
<object width="1280" height="720">
<param 
    name="movie" 
    value="http://www.youtube.com/v/Hl-zzrqQoSE
           ?version=3
           &hl=en_US
           &rel=0">
</param>
<param name="allowFullScreen" value="true">
</param>
<param name="allowscriptaccess" value="always">
</param>
<embed src="http://www.youtube.com/v/Hl-zzrqQoSE
            ?version=3
            &hl=en_US
            &rel=0" 
       type="application/x-shockwave-flash" 
       width="1280" 
       height="720" 
       allowscriptaccess="always" 
       allowfullscreen="true">
 </embed>
 </object>
The AntiSamy config:
 <common-regexps>
     <regexp name="YouTubeURL" value="(\s)*(http(s?)://)www.youtube.com/v/[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&;:\-_~,\?=/!]*(\s)*"/>
 ....
<!-- Tags related to YouTube -->
<tag name="object" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
    <literal-list>
        <literal value="application/x-shockwave-flash"/>
    </literal-list>
</attribute>
<attribute name="data">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
</tag>
<tag name="embed" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
    <literal-list>
        <literal value="application/x-shockwave-flash"/>
    </literal-list>
</attribute>
<attribute name="allowfullscreen">
    <regexp-list>
        <regexp name="boolean"/>
    </regexp-list>
</attribute>
<attribute name="allowscriptaccess">
    <literal-list>
        <literal value="always"/>
    </literal-list>
</attribute>
<attribute name="src">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
<attribute name="movie">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
</tag>
Currently my config on iframe:
    <!-- Frame & related tags -->
    <tag name="iframe" action="remove"/>
    <tag name="frameset" action="remove"/>
    <tag name="frame" action="remove"/>
The new YouTube iframe:
<iframe 
    width="1280" 
    height="720" 
    <!--   src="https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE"  -->
    src="https://www.youtube.com/embed/Hl-zzrqQoSE" 
    frameborder="0" 
    allowfullscreen>
</iframe>
I figure the code for iframe should like this:
<tag name="iframe" action="validate">
        <attribute name="height"/>
        <attribute name="width"/>
        <attribute name="frameborder"/>
        <attribute name="src">
            <regexp-list>
                <regexp name="YouTubeURL"/>
            </regexp-list>
        </attribute>
        <attribute name="allowfullscreen">
            <regexp-list>
                <regexp name="boolean"/>
            </regexp-list>
        </attribute>
</tag>
How do you change the regex so it will accept the old and new links like:
    https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE
    https://www.youtube.com/embed/Hl-zzrqQoSE
    https://www.youtube.com/v/Hl-zzrqQoSE
    http://www.youtube-nocookie.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0
    http://www.youtube.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0"
				
                        
I took the liberty to remove unnecessary capture groups, escapes and characters.
Although I personally would use something like:
That puts the entire youtube URL in match group 0 and the video id in match group 1. Also it doesn't make a whole lot of sense to use unicode properties when youtube's URLs don't contain unicode characters.
Demo: http://rubular.com/r/jv4zO9ys2L