[fabianekc]

OwnYourData advertises the DPP Linter with Google Ads. This pull request adds a consent banner and one conversion, "check completed", with the same rules as on the DPP Service. Without GOOGLE_ADS_ID nothing of it is active; the manifest sets the label and leaves the ID empty, so this deployment changes only the footer and the API documentation.

Consent and tag

• Before a choice nothing is loaded from Google. "Decline" and "Accept" look alike; the choice is kept in localStorage for twelve months; "Cookie settings" in the footer opens the banner again; declining after accepting deletes the _gcl_ and _gac_ cookies on the host and its parent domains.
• After "Accept": Google Consent Mode v2 in basic mode (ad_storage and ad_user_data granted, ad_personalization and analytics_storage denied), ad personalisation signals off, only gtag.js for the ID, no gtag("config"), no analytics, no remarketing, no enhanced conversions.
• app/javascript/consent.js is adapted from the consent script of the DPP Service (OwnYourData/dpp-service-public, Apache License 2.0).

Conversion

• One conversion per completed check (the API answered with a result); none when the check cannot be run.
• No user data: the conversion reports the address of the start page with its ad click identifier (gclid, gbraid, wbraid) but without the product identifier, and only the origin of the referrer. The result is not sent.
• The start page used to replace its whole query with ?productId=… when a check started, which dropped the click identifier before the conversion. It now keeps the click identifiers next to the product identifier, so that a tag without config can attribute the conversion; nothing goes through the server.

Also

• The API documentation loaded web fonts from fonts.googleapis.com; the rswag-ui template is now overridden without them.
• The footer links the privacy policy of the DPP services, https://dpp-service.ownyourdata.eu/privacy.

Checks

• test/integration/consent_test.rb, test/integration/api_docs_test.rb, test/javascript/click_ids.test.js.
• test/browser/consent_check.mjs against a local instance, with requests to Google blocked: no request to Google before a choice on the start page, result pages, a page whose check cannot be run, the API documentation and an unknown path; after Accept only gtag/js?id=AW-…; one conversion with the label after a check, without the product identifier; withdrawal works. With the tag loaded and only the conversion requests blocked, the request the tag would send carries the click identifier and no product identifier. Light and dark at 375 and 1280 px without horizontal scrolling. Without an ID: no banner, no cookie settings, no request to Google.
• The API and the daily runs are unchanged.