feat(container): unify cookie consent with the OVHcloud CMP

[MehdiZaghouani]

Summary

Integrates the OVHcloud CMP (Consent Management Platform) into the container
app to unify cookie consent across OVHcloud properties (the website, the order
funnel and Manager V8 already use it). Two commits:

1. feat(container): add cmp facade to load the consent platform — a small
   framework-agnostic facade (src/cmp/) that declares the host context in
   window.__cmpConfig and injects the two-stage CMP loader.
2. feat(container): drive tracking consent through the cmp — CookiePolicy
   becomes a bridge: the CMP banner replaces the in-house consent modal for
   EU/CA and its choices drive the existing shell tracking plugin.

The Piano tracking stack is untouched: same bundled SDK, same tracking
plugin methods, same postMessage RPC for child apps (legacy iframes included).
Only the source of the consent boolean changes — the CMP instead of the
in-house TC_PRIVACY_CENTER modal.

ref: #MANAGER-22048

Workflow

Container boot (EU/CA)
  |
  +-- cmp.load()
  |     +-- window.__cmpConfig = { locale, region, environment, scripts: [] }
  |     |     (scripts intentionally empty: the CMP owns the consent UI and
  |     |      the cmp_consent cookie ONLY -- it injects no tag container,
  |     |      Piano stays bundled and gated by the tracking plugin)
  |     +-- inject cmp.iife.js (loader -> version.json -> versioned bundle)
  |
  +-- cmp.whenReady()
        |
        +-- cmp.isError() ------------------> FALLBACK: legacy TC_PRIVACY_CENTER
        |     (loader blocked, outage)        modal, unchanged behavior
        |
        +-- cmp.getConsent()
        |     +-- null ...................... CMP banner on screen;
        |     |                               tracking waits (beforeConsent)
        |     +-- { analytics: true } ....... trackingPlugin.init(true)
        |     +-- { analytics: false } ...... trackingPlugin.setEnabled(false)
        |                                     + delete clientSideUserId
        |
        +-- cmp.onConsentChange(choices)
              -> trackingPlugin.onUserConsentFromModal(choices.analytics)
                 (banner choice, preferences update, withdrawal)

US region: unchanged -- no CMP, tracking auto-enabled as today.
Child apps: unchanged -- they keep calling the tracking plugin over the
shell postMessage RPC; consent stays enforced centrally in the container.

Key design points

• Consent mapping: the Manager's single tracking consent maps to the CMP
  analytics category; cmp_consent becomes the source of truth (read
  exclusively through the window.__cmp API, never parsed directly).
• Endpoints: production (manager.{eu,ca,us}.ovhcloud.com) loads the CMP
  from www.ovhcloud.com (CORS-open, verified); every other hostname declares
  preproduction (fail-closed) and loads the preprod CMP — local dev works
  with zero setup.
• Resilience: cmp:ready is armed before injection and time-bounded
  (10 s); on loader error or timeout the legacy modal takes over
  automatically, so consent collection survives a CMP outage.
• Existing users are re-prompted once by the CMP banner (their consent
  lives in the legacy cookie, which the CMP does not read) — fresh consent
  under the current policy version.

Tests

• 21 new/updated tests (13 cmp facade, 8 CookiePolicy bridge covering the CMP
  paths, the consent-change forwarding, and the 3 legacy-fallback scenarios).
• Full container suite green (235 tests). Validated locally end-to-end:
  banner replaces the legacy modal, accept/refuse drive Piano, preferences
  modal, legacy fallback when the CMP host is blocked.