Add surrogate-based replacement for YouTube JS API

[ghostwords]

Fixes #2849. Follows up on #2805 and #2280.

To be followed up with another round of reviewing error reports and fixing the major remaining issues so that we can remove YouTube from the yellowlist (#1593). Should also look into handling youtube-nocookie.com.

Working YT JS API examples:

• https://www.aljazeera.com/program/talk-to-al-jazeera/2022/9/16/iran-raisi-no-benefit-in-direct-nuclear-negotiations-with-us
• https://www.huffpost.com/entry/trevor-noah-scheme-voter-suppression_n_5bc99e6fe4b0d38b5876e1c6
• https://www.milieucentraal.nl/minder-afval/afval-scheiden/tips-voor-een-schone-gft-bak/ (scroll to bottom, video uses a custom play/pause control that calls YT.Player API methods)
• https://theprovince.com/category/hot-topics/ ("LATEST VIDEOS" on the right)
• https://youglish.com/pronounce/handler/english/us?
• https://www.grundfos.com/de/learn/ecademy/all-courses/alpha2/introduction-to-balancing-in-one-family-homes
• https://returntomonkeyisland.com/trailer
• https://browardcountyfence.com/wood-fence/ (scroll to bottom, does not use window.onYouTubeIframeAPIReady)
• https://nationalpost.com/news/world/ivanka-trump-jared-kushner-rent-40000-per-month-condo-while-billionaire-bunker-home-gets-built
• https://www.theguardian.com/us-news/2021/jan/07/donald-trump-final-13-days-security-threat-politicians-activists-warn (scroll down)
• https://www.theguardian.com/football/video/2022/jun/19/memphis-depay-shows-off-skills-on-dirt-pitch-during-community-football-match-in-ghana-video (multiple YT videos on one page)
• https://www.france24.com/en/asia-pacific/20210428-india-s-covid-19-death-toll-passes-200-000-as-who-says-variant-found-in-17-countries (multiple videos, hero video requires YT.PlayerState in surrogate)
• https://kzitem.info/news/rafaa-156-reveals-from-magharebia-about-the-ambitions-of-the-ikhwane-in-the-kabylie-region/0rCamoN9kWSErJg (uses the old /player_api endpoint)

Examples with issues:

• https://ed.ted.com/lessons/what-is-schizophrenia-anees-bahji (placeholder shifted down from where it should be)
• https://steamcommunity.com/app/294100/videos/ (blocked img.youtube.com thumbnails)
• https://www.47bjjcoop.com/ ("x" and "?" are not clickable)

Broken examples:

• https://www.discogs.com/artist/3476-Jah-Wobble (scroll down to Videos underneath the album list)
• https://www.vive.com/us/ (clicking on play button produces "Uncaught TypeError: window.YT.ready is not a function")
• https://news.uchicago.edu/story/how-one-scholar-shaped-writing-generations-students
• https://www.ainonline.com/aviation-news/video/charles-alcock-remembers-his-early-days-ain-involving-bourbon-and-gun-ains-50th-anniversary (empty videoId in initial Player config)
• https://www.vox.com/22362894/which-covid-vaccine-is-better-moderna-vs-pfizer-video (nested frame, lazy loaded)
• https://www.mediapart.fr/journal/france/290321/affaire-myriam-sakhri-la-famille-espere-une-reouverture-de-l-enquete (Embedly)
• https://medium.com/@samuelwestwood/time-saving-things-that-actually-work-trust-me-28461a6f4a41 (nested frame)
• https://www.msn.com/en-us/health/medical/super-flower-blood-moon-and-total-eclipse/vi-AAKoV1K?category=foryou

Non-JS API YT broken examples:

• https://www.esquire.com/entertainment/music/a34633291/heavy-metal-nazi-anti-fascist-movement/ (replacement fails, blocked img.youtube.com thumbnails)
• https://kotaku.com/peach-is-a-monster-in-smash-ultimate-pros-say-1831613178
• https://www.colegioalarcon.com/orientablog/videos-mindfulness-por-edades/
• https://apolisgreek.com/
• https://www.diyphotography.net/secret-filming-fast-moving-objects-25-million-frames-per-second-mirrors/
• https://www.borussia.de/de/aktuelles/news/2021-12-21-eberl-ein-turbulentes-und-surreales-jahr (youtube-nocookie.com, some sort of z-index (?) issue where replacement happens but our placeholder is covered up by page's own video placeholder)

Brave/DDG test pages:

• https://fmarier.github.io/brave-testing/social-widgets.html
• https://privacy-test-pages.glitch.me/privacy-protections/youtube-click-to-load/