Restrict new windows in replay + improved service worker loading + better error messages

[ikreymer]

• Restrict new window / link opening in new window via target overrides, as per Resolve issues with window.open / anchor target rewriting wombat#94
• Errors: More error messages, such as due to cross-origin iframes lacking service-worker support and Firefox-specific messages
• Embeds: Rename noSandbox -> sandbox, don't make default to support window target reuse
• Embeds: Add requireSubdomainIframe embed attribute to only allow embed if loaded from a cross-origin / subdomain iframe.
• Docs: Add embed.html and sample embed, also added to embedding docs

This change makes the top-frame have a name, which allows the target rewriting to force new windows to open in the top frame instead. However, this can not work if sandbox attribute is set, so removing it by default, for better behavior of opening new windows in the same frame.

[ikreymer]

@matteocargnelutti
Recommendations for old browser were part of a previous PR:
https://github.com/webrecorder/replayweb.page/blob/main/src/embed.js#L131

[matteocargnelutti]

@ikreymer Looks good to me! Tested on warc-embed using a local dev build of embed-cors-check.

I understand the reasoning behind the transition from noSandbox to sandbox.
Although most folks likely use versioned imports of ui.js and sw.js via jsdelivr, I feel like an additional warning should be given, as this change has security implications.
Maybe a console.warn could be issued when sandbox is absent?
It could also be worth adding one for when noSandbox is defined, as a deprecation notice.

Thanks for taking my feedback into account, excited for this new version of replayweb.page.

[ikreymer]

@matteocargnelutti added a console.warn if noSandbox is used.