require the unfiltered_html capability before a user can use manual tracking mode

[diosmosis]

Description

Primary changes:

• requiring unfiltered_html before a user can use manual tracking mode.
• switching to local tracking generation instead of using the SitesManager.getJavascriptCode API method (to prevent someone from using a malicious server instead).
  • the Matomo API (specifically SitesManager.getSiteUrlsFromId) is still used since not all the required information for the tracking code exists in Connect Matomo.

Other fixes:

• the "CDN URL", "CDN URL (SSL)" and "Force Matomo to use a specific protocol" settings are now JSON encoded and validated before being written into the generated tracking code.
• when site search tracking is enabled, the search term is now escaped for the JavaScript string it is written into.
• a site connected through the deprecated "Self-hosted (PHP API)" method no longer stores "/" as its Matomo URL when its settings are saved.
• both tracking code textareas are read-only unless the user may enter code manually and the site is in manual mode.
• prepare_plugin_display_name() escapes the display name once, at save time. save() no longer escapes it, which used to end up double encoding it.
• in proxy mode, the noscript pixel URL was not correctly being replaced with the proxy URL (now fixed).

Other changes:

• switching tracking mode will now delete the stored tracking code if it is generated tracking code or if the user is unprivileged, so an untrusted admin can't bypass the review check by disabling tracking mode temporarily.
• when saving tracking settings, fall back to the stored mode when submitting an empty track_mode
• a check now exists that asks admins to review tracking code that was entered manually before this version which requires unfiltered_html, to ensure nothing unsafe was entered within a previous version.
  • note: the check is only run if the user updated from 1.12 or earlier so updating to a new version after this one will no longer trigger the check
• the versions a site has run are recorded in a new hidden "version_history" setting.
• a new integration test is introduced that ensures the local tracking code generation introduced in this version is identical to the latest Matomo version's tracking code generation.
• add_notice() now will skip notices that already exist in the notice array so duplicates are not shown to the user.
• get_matomo_url() was rewritten: the two cloud modes keep their generated URLs, but every other mode uses the URL the site names. only the deprecated PHP API mode falls back to asking Matomo itself (via the SettingsPiwik class).
• the ddev environment now has a command for setting up a local Matomo (for use with the tracking code fidelity test)

Checklist

• [✔/✖/NA] I have understood, reviewed, and tested all AI outputs before use
• [✔/✖/NA] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated