refactor (fix) 1.5.7 use hosted vendorlist by default

[potench]

background

IAB unpublished v1 of the global vendor list which breaks the CMP if not using a cached / self-hosted version of the global vendor list.

• Default to self-hosted vendor list
• Revert to self-hosted vendor list even if IAB global vendor list is manually configured by integrator
• Fix cookie warnings by adding SameSite=None;secure & SameSite=Lax props for cookies (https vs http)

test plan

yarn dev
# browse to http://localhost:8080/reference.html