fix: prevent Chrome mobile permission prompts on embedded chat widget

[DanKunleLove]

Summary

Fixes #35330 — the embedded chatbot bubble widget triggers Chrome mobile permission prompts ("access to apps and services") instead of rendering, because the iframe unconditionally requests microphone permission.

Root cause

web/public/embed.js line 159:

iframe.allow = "fullscreen;microphone";

On Chrome mobile, requesting microphone in the iframe allow attribute triggers a browser permission prompt even when the chat doesn't use audio input. This blocks the widget from rendering until the user grants permission.

Changes

• Make microphone permission opt-in via enableMicrophone config flag in difyChatbotConfig (defaults to false)
• Fix allow attribute syntax — use space-separated format per the Permissions Policy spec ("fullscreen; microphone" not "fullscreen;microphone")
• Update iframe embed example in the sharing modal to only request fullscreen by default
• Update both embed.js and embed.min.js

Usage

Users who need microphone access (e.g., for voice input) can opt in:

window.difyChatbotConfig = {
  token: 'your-token',
  enableMicrophone: true
}

Test plan

• Embed chat widget on a test page without enableMicrophone — verify no permission prompt on Chrome mobile
• Embed chat widget with enableMicrophone: true — verify microphone permission works when needed
• Verify widget renders correctly on desktop browsers (Chrome, Firefox, Safari)
• Verify existing chat functionality is unaffected (text input, responses)

Fixes #35330