Playlist: Disable waveform player auto-init

[scruffian]

What?

Follow-up to #81342.

Updates @arraypress/waveform-player to 1.26.0, uses its document-level auto-init opt-out before Gutenberg imports the dependency, and sanitizes custom SVG icons passed through the Playlist waveform utility.

Why?

The dependency's import-time scan can claim waveform markup before the Playlist block initializes what it owns, and custom icon markup should be cleaned at Gutenberg's boundary before it reaches the player.

How?

Adds a pre-import document attribute guard, restores any previous attribute value after import, allowlists SVG icon elements and attributes before writing data-play-icon / data-pause-icon, and removes the old 1.23.0 patch-package patch.

Testing Instructions

Run:

npm run test:unit -- packages/block-library/src/utils/test/waveform-player-dependency.js packages/block-library/src/utils/test/waveform-utils.js
npm run lint:js -- packages/block-library/src/utils/waveform-utils.js packages/block-library/src/utils/disable-waveform-autoinit.js packages/block-library/src/utils/test/waveform-player-dependency.js packages/block-library/src/utils/test/waveform-utils.js

Testing Instructions for Keyboard

No keyboard-specific UI behavior changed.

Screenshots or screencast

N/A

Use of AI Tools

This PR was authored with help from ChatGPT/Codex and reviewed by the contributor.

[github-actions]

Size Change: +3.72 kB (+0.05%)

Total Size: 7.72 MB

📦 View Changed

Filename	Size	Change
build/modules/block-library/playlist/view.min.js	18.9 kB	+1.77 kB (+10.32%)	⚠️
build/scripts/block-library/index.min.js	359 kB	+1.95 kB (+0.55%)

_{compressed-size-action}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: scruffian <scruffian@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[scruffian]

We don't need this because waveform player now validates this array.