Lazy-load social SDKs only when an embed is present (2.x)

[GaryJones]

Summary

Liveblog enqueued the Facebook, Twitter/X, Instagram and Reddit JavaScript SDKs on every Liveblog-enabled post, regardless of whether the post or its entries actually contained an embed from any of those services. As reported in #926, this meant visitors' browsers contacted four third-party domains on every Liveblog page, leaking request data to platforms whose content was never displayed, adding avoidable page-load overhead, and complicating Content Security Policy and consent compliance. A site using a single provider, or no social embeds at all, still paid the cost of all four.

This is the backport of #928 (merged to develop) onto the 2.x architecture. The behaviour and front-end loader are identical; only the PHP wiring differs to fit 2.x.

On 2.x the SDK logic lives in AssetManager. Rather than enqueuing every SDK on wp_enqueue_scripts, the plugin now passes the (still filterable) provider URL map to the front-end app through liveblog_settings. The React entry renderer already runs triggerOembedLoad() on every entry's mount and update, so that became the natural hook: for each provider it detects provider-specific embed markup, and if found either re-processes the entry (when the SDK is already present) or injects the SDK once. Because it runs per entry, it correctly handles embeds arriving in entries polled after the initial page load, not just those present on first render.

The now-unused enqueue_embed_sdks() and add_async_to_embed_sdks() methods and their hook registrations in PluginBootstrapper have been removed; init_embed_sdks() is retained, as it applies the liveblog_embed_sdks filter and populates the map now consumed by the front-end. The filter's __return_empty_array opt-out and per-provider removal continue to work and now also gate lazy loading.

A known limitation worth a reviewer's eye

Reddit's widgets.js exposes no reliable client-side re-process API; it only scans the document when it first loads. A Reddit embed arriving in an entry polled after the SDK has already loaded therefore won't auto-render. This is not a regression (Reddit was never re-processed client-side before either), but it is a gap if true live-update parity for Reddit is wanted later.

Note on the Facebook URL

The default Facebook SDK URL previously carried an HTML-encoded & in its hash. That was harmless when passed through esc_url() on a server-side enqueue, but would break a client-injected src, so it is now stored un-encoded.

Test plan

• Integration tests: composer test:integration (rewritten EmbedSdksTest asserts the SDKs are no longer enqueued on a liveblog post and that the SDK map is exposed in the localised front-end settings, plus filter customisation and the empty-array opt-out). Verified locally: 5 tests, 14 assertions passing.
• JS unit tests: npm test (updated triggerOembedLoad tests cover on-demand injection, single-injection across entries, and the no-markup / no-config cases). Verified locally: 16 tests passing.
• Manual: enable Liveblog on a post with no social embeds and confirm no connect.facebook.net, platform.twitter.com, instagram.com or embed.reddit.com requests are made. Add a single tweet and confirm only the Twitter SDK loads, including in a newly published entry.

Fixes #926