[Elimpizza]

Context

Hypothesis LMS assignments built from Canvas Pages show the page through Via. By
default Via rewrites every iframe in a page so it also loads through Via.
Canvas Pages ask Via not to do that with via.proxy_frames=0
(hypothesis/lms#6045, Feb 2024), so embedded players load directly from their
own sites.

That flag was only honoured server-side, in the HTML viahtml rewrites.
wombat.js, pywb's client-side rewriter, kept proxying any iframe a page script
inserted or re-inserted after load. Page-builder runtimes such as DesignPlus
rebuild the page that way, so on those pages a public-link Canvas Studio embed
ended up proxied anyway, and Via's JavaScript rewriting breaks Studio's player
(same failure mode as Kanopy in product-backlog#1760).

This is one of the two causes behind product-backlog#1748 and #1749. The other,
toolbar (plug-icon) embeds that use Canvas's external_tools/retrieve route,
cannot work inside a frame at all and is handled in hypothesis/lms#7479 by
turning them into a link.

Changes

Honour via.proxy_frames=0 in client-side rewriting too. A proxy_frames
template helper reads the flag the same way the server-side hook does. When it
is off, head_insert.html wraps wombat's rewriteUrl so that iframe and frame
URLs (modifiers if_ and fr_) are returned unchanged. Every iframe-rewriting
path in wombat goes through that method, so this covers iframes added via
innerHTML, the src property, setAttribute and insertAdjacentHTML. All
other resources are rewritten as before, and pages without the flag are
untouched.

Guard the override against pywb changes. The wrapper only installs if
_WBWombat.prototype.rewriteUrl is a function. If a future pywb renames it,
behaviour falls back to today's instead of throwing on the first rewrite.

Testing

Unit test for the helper (flag "0" and junk disable, "1" and absent keep the
default), and a functional test that the override is in the served page only
when the flag is "0".

Verified locally against a page that re-inserts its iframes after load, served
through local viahtml with the flag:

• before: the re-inserted iframes were requested through /proxy/if_/... and
  the Studio player broke
• after: all iframes load directly and the player keeps playing
• without the flag: iframes are still proxied
• with the flag: images and scripts inserted by script are still proxied

Not covered: the server-side flag being ignored under load (shared
hooks.context with gevent), which is a separate change.