feat(FOUR-32734): allow ProcessMaker login in cross-site iframes

[gproly]

Set CSP frame-ancestors and relax session cookies (SameSite=None, Secure, partitioned) when IFRAME_EMBEDDING_ENABLED=true and IFRAME_EMBEDDING_ALLOWED_ORIGINS lists parent origins (e.g. http://localhost:8093).

Example: pmList embeds PM login via

<iframe src="https://127.0.0.5:8092/login" ...></iframe>.

Security notes:

• Only enable when cross-site embedding is required; disable when not in use.
• IFRAME_EMBEDDING_ALLOWED_ORIGINS must list explicit parent origins; empty allowlist does not activate relaxed cookies or CSP.
• SameSite=None increases cross-site cookie exposure; CSRF risk is higher—restrict allowed origins to trusted domains only.
• In production, only https:// origins are accepted for frame-ancestors (http:// entries are ignored).
• Third-party cookie blocking in browsers may still break iframe login; test target browsers and prefer HTTPS on both parent and PM.
• Do not use as a substitute for SSO; treat as a narrow integration option.

https://processmaker.atlassian.net/browse/FOUR-32734

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[pmPaulis]

@gproly
All the changes related to this configuration needs to add in the package-product-analytics.
In sync wiht support we will add the considerations to know for this change
Regards,