Subbranch of issue/5813: Allow https placeholder examples for ranking-image (experiment)

[kevdevlu]

Subbranch of #5834

Widens src's x-allowed-schemes to [public, https] so examples can reference an external placeholder (https://placehold.co/1000x500) directly, instead of shipping a local file via az_media. Two supporting pieces make this actually work:

• az_media_canvas_storable_prop_shape_alter() + a hook_module_implements_alter() to force it last: restores the media-library-backed widget for real editing, which Canvas's own mediaLibraryStorablePropShapeAlter() only applies when x-allowed-schemes is exactly ['public'] (confirmed by reading it directly) - adding 'https' breaks that exact match and Canvas's core matching falls back to a plain upload widget with no Media Library integration at all.
• ImageStyleTwigExtension: detects an absolute URL pointing back at this site's own public files and converts it back to a public:// URI before styling (ImageStyle::buildUri() otherwise mangles any http(s)-scheme string, local or not, into a bogus derivative path); a genuinely external URL is returned unprocessed, since there's nothing local to generate a WebP/scaled derivative from.

With examples now pointing at a remote URL, az_media's local placeholder-1000x500.png (and the hook_install()/hook_update_N() code that shipped it) is no longer needed - removed both.

Kept on its own branch rather than merged into issue/5813: this is meaningfully more complex (forks a piece of Canvas's own internal expression logic, adds a hook-ordering dependency, adds a new runtime dependency on an external host) than the already-working alternative - a small, local placeholder image shipped via az_media - for a purely cosmetic, admin-only hover-preview thumbnail. Preserved here in case there's a real future case for supporting genuine external image URLs, rather than just to swap where one placeholder graphic's pixels come from.

Description

Release notes

Related issues

How to test

Types of changes

Arizona Quickstart (install profile, custom modules, custom theme)

• Patch release changes
  • Bug fix
  • Accessibility, performance, or security improvement
  • Critical institutional link or brand change
  • Adding experimental module
  • Update experimental module
• Minor release changes
  • New feature
  • Breaking or visual change to existing behavior
  • Upgrade experimental module to stable
  • Enable existing module by default or database update
  • Non-critical brand change
  • New internal API or API improvement with backwards compatibility
  • Risky or disruptive cleanup to comply with coding standards
  • High-risk or disruptive change (requires upgrade path, risks regression, etc.)
• Other or unknown
  • Other or unknown

Drupal core

• Patch release changes
  • Security update
  • Patch level release (non-security bug-fix release)
  • Patch removal that's no longer necessary
• Minor release changes
  • Major or minor level update
• Other or unknown
  • Other or unknown

Drupal contrib projects

• Patch release changes
  • Security update
  • Patch or minor level update
  • Add new module
  • Patch removal that's no longer necessary
• Minor release changes
  • Major level update
• Other or unknown
  • Other or unknown

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.
• My change requires release notes.

[az-digital-bot]

Tugboat has finished building the preview for this pull request!

Link:

• https://pr5849-dfkiigkybjecupixpkzlntwpowirjhla.tugboatqa.com

Dashboard:

• https://dashboard.tugboatqa.com/6a691fc535740a1d142c9cbc