KB : video embed support via slash command

[f2cmb]

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

• It fixes Video embed roadmap#328
• Here is a brief description of what this PR does : New Tiptap module (better than use the YT existing one + custom for other support).

YT/ Vimeo / Dailymotion only. Slash Command integration only.

Possible followup :

Give and admin the possibility to add custom providers.

Screenshot :

[AdrienClairembault]

Seems to work fine, I didn't check the code in details as there is almost 2k lines.

[f2cmb]

Asked for review @cedric-anne today

[cedric-anne]

This represent a huge amount of code to just support youtube/vimeo/dailymotion providers.

I cannot tell how many people will want to use this feature, and I cannot tell either how many people will want to add their own self-hosted videos using just a https://example.org/myvideo.mp4 URL, but, IMHO, handling only video files URLs and render them in a <video> tag would probably cover more use cases.

Ping @orthagh

[cedric-anne]

Is allow-same-origin necessary? As far as I understand, it will allow the iframe to access the GLPI page DOM.

Is allow-popups necessary?

Suggested change

	. ' sandbox="allow-scripts allow-same-origin allow-presentation allow-popups"'
	. ' sandbox="allow-scripts allow-presentation"'

[f2cmb]

Is allow-same-origin necessary?

Yes : I tested removing it and the players won't load: without it the iframe gets an opaque origin and can't read its own cookies/localStorage.

As far as I understand, it will allow the iframe to access the GLPI page DOM.

It won't : cross-origin DOM access is blocked by the Same-Origin Policy regardless of the sandbox. The allow-scripts + allow-same-origin escape only applies when the frame is same-origin with the page, and src is always a hard-coded provider host (youtube-nocookie.com / player.vimeo.com / dailymotion.com).

Is allow-popups necessary?

No, removed it (only used by the players' "watch on …" buttons). Also dropped referrerpolicy (already the browser default). Final set: allow-scripts allow-same-origin allow-presentation.

[f2cmb]

@cedric-anne i processed your concerns (partially for allow- comment, see explanations above.

Waiting for @orthagh decision : drop external provider, add