feat: embedded iframe checkout option (one-off payments)

[MHJaafar9869]

Summary

Adds an Embedded Checkout gateway option that renders the GetPayIn hosted checkout in an iframe on the merchant's site instead of redirecting to it. It's a config toggle (No/Yes) alongside the existing options (Payment Action, Installments, etc.).

How it works

When Embedded Checkout = Yes for a one-off payment:

1. createCheckoutUrl() sends iframe=1 in the v2 init POST body. The backend (API/V2/.../ExternalPaymentIntegrationController::generateInvoice) reads iframe from the body and bakes iframe=1 into the signed checkout_url before signing — so this is the correct trigger. (Appending &iframe=1 to the returned URL would break the signed middleware.)
2. beginTransaction() branches to renderIframe() (the original redirect path is preserved as renderRedirect()).
3. renderIframe() embeds the checkout and installs a message listener matching the backend's paylink_payment postMessage contract — {type, success, invoice_id, invoice_status, message}. On success it moves the top window to return_url, on failure to error_url.

Safety / correctness guards

• Origin-checked postMessage — the listener rejects any message whose origin isn't the configured GetPayIn host, so a foreign frame can't spoof a "paid" result. (The checkout also targets its postMessage at the integration's registered Origin, so it's only delivered to a parent on that exact origin.)
• Recurring excluded — iframeEnabled() returns false for subscriptions, because the recurring init endpoint does not sign the iframe flag. Those keep redirecting.
• allow="payment *" on the iframe for Apple/Google Pay in the cross-origin frame, plus a target="_top" fallback link for browsers that block third-party frames.

Verification

• php -l clean across all files; signing golden-vector tests pass (ALL SIGNATURE CHECKS PASSED).
• Contract verified statically against the GetPayIn backend (init endpoint, checkout page, SecurityHeadersMiddleware frame-ancestors, blade postMessage payloads).

⚠️ Not yet tested end-to-end on a live Vik install (the framework isn't on the dev box). Recommend a live test booking with Embedded Checkout = Yes before release — in particular confirming VikBooking populates return_url at beginTransaction time; if empty for a given component, the listener falls back to reloading the top window rather than landing on the order page.

Bumps version 1.2.1 → 1.3.0; documents the option in README, CHANGELOG, and the .pot template.