Embeddable dashboard

[ukutaht]

Changes

New branch for embed mode based on #772. Mostly the same feature, thanks a lot @aymanterra @bradkane for your research and contributions on this. I'll see if I can add you as addition authors for the commit when I merge it.

The main change from the original PR is that the embed mode is done with no configuration or persistence on the server side. Shared links will always remove X-Frame-Options header and set SameSite: None; secure for cookies. This relaxed security is only applied to shared links, the rest of the application still uses secure browser headers and restricts cookie domain.

Since shared links are read-only, and specifically meant for sharing stats outside of Plausible, I don't think it introduces any security issues. Happy to be convinced otherwise.

TODO:

• Theming for light/dark mode. Allow the parent page to specify which theme should be used.
• Allow passing in the background color for the dashboard. Make sure transparent works.

EDIT: transparent backgound does work but the header looks a bit weird. Maybe transparent cannot work due to the sticky header we have.

I think this should be enough for a first release. We can add more elaborate external CSS theming in the future if there's demand.

Tests

• Automated tests have been added

Changelog

• Entry has been added to changelog

Documentation

• Docs have been updated