Render APS creatives in opaque data frames

[ChristianPavilonis]

Summary

• Render APS creatives through nonce-bound, nested opaque data: documents so HTTPS creative origins are retained without granting publisher access.
• Add exact-origin renderer containment, one-shot PUC top-page mounts, and APS-wide publisher frame-ancestors 'self' protection against recursive publisher framing.
• Cover direct and real PUC rendering in Chromium, Firefox, and WebKit; document the CSP and redirect compatibility trade-offs.

Changes

File	Change
crates/trusted-server-core/src/integrations/aps.rs	Serve the data-bootstrap renderer mode and static renderer sources.
crates/trusted-server-core/src/response_privacy.rs	Append an independent APS publisher frame-ancestors 'self' CSP policy.
crates/trusted-server-js/lib/src/integrations/aps/	Add the bootstrap/container/renderer documents and nonce- and port-bound data-frame rendering flow.
crates/trusted-server-js/lib/src/integrations/gpt/index.ts	Register and consume one-shot PUC top-page mount capabilities.
crates/trusted-server-js/lib/src/core/request.ts	Cancel pending APS work before generic slot replacement.
crates/trusted-server-js/lib/test/	Add renderer, capability refresh/replay, and replacement-cancellation coverage.
crates/trusted-server-integration-tests/browser/	Add real PUC fixture and cross-browser APS isolation coverage.
docs/guide/integrations/aps.md	Document containment architecture, CSP requirements, and compatibility trade-offs.

Closes

Closes #999

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, adapter parity tests, Cloudflare/Spin Clippy targets, git diff --check, Chromium browser integration tests (Next.js and WordPress), and Firefox/WebKit browser integration tests (Next.js).

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• No new logging added; existing code uses project-standard log macros rather than println!
• New code has tests
• No secrets or credentials committed