[webview_flutter_web] Add the credentialless iframe attribute.

[uldall]

This PR makes it possible to specify whether the <iframe> should have the attribute credentialless set to true or false.

• [webview_flutter_web] Support for setting the credentialless attribute on iframe flutter#151557

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the Tree Hygiene page, which explains my responsibilities.
• I read and followed the relevant style guides and ran the auto-formatter. (Unlike the flutter/flutter repo, the flutter/packages repo does use dart format.)
• I signed the CLA.
• The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• I linked to at least one issue that this PR fixes in the description above.
• I updated pubspec.yaml with an appropriate new version according to the pub versioning philosophy, or this PR is exempt from version changes.
• I updated CHANGELOG.md to add a description of the change, following repository CHANGELOG style, or this PR is exempt from CHANGELOG changes.
• I updated/added relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or this PR is test-exempt.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

[flutter-dashboard]

It looks like this pull request may not have tests. Please make sure to add tests before merging. If you need an exemption to this rule, contact "@test-exemption-reviewer" in the #hackers channel in Chat (don't just cc them here, they won't see it! Use Discord!).

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing.

[uldall]

Example usage:

late final PlatformWebViewControllerCreationParams params;
if (WebViewPlatform.instance is WebWebViewPlatform) {
  params = WebWebViewControllerCreationParams(
    iFrameCredentialless: true,
  );
} else {
  params = const PlatformWebViewControllerCreationParams();
}

_webViewController = WebViewController.fromPlatformCreationParams(params);

[uldall]

Example of how it looks when the attribute is added:

[stuartmorgan]

Thanks for the contribution! You’ve checked boxes in the PR checklist above that are not reflected in this PR, so I’m assuming this is a work in progress and am marking it as a Draft. Please review the checklist, updating the PR as appropriate, and when the checklist reflects the state of the PR as posted please feel free to mark it as ready for review.

[uldall]

Thanks for the contribution! You’ve checked boxes in the PR checklist above that are not reflected in this PR, so I’m assuming this is a work in progress and am marking it as a Draft. Please review the checklist, updating the PR as appropriate, and when the checklist reflects the state of the PR as posted please feel free to mark it as ready for review.

I have added tests and comments now. I am not sure about whether I am supposed to update the pubspec.yaml and CHANGELOG.md? Sorry about the potentially stupid question. This is my first PR on the Flutter project.

[uldall]

Would it be preferable if I changed this PR to use a Map<String, String> of attributes instead so it became more generic?

[stuartmorgan]

From triage: Ping @ditman on the design question above.

[ditman]

Small nit with setting the credentialless attribute only when really needed.

[ditman]

Setting credentialless to any value results it in being true

• https://jsfiddle.net/ditman/obufjvtk/ (try setting it here to "false", "potato" or "any-value-whatsoever" 😄)

Set the attribute only iFrameCredentialless is true.

[ditman]

Would it be preferable if I changed this PR to use a Map<String, String> of attributes instead so it became more generic?

@uldall I think it's better that we do this using the type safety of Dart and package:web rather than a stringly typed map :)

(PS: credentialless is only supported in Chrome browsers for now, we may need to add a note to the parameter itself so users are aware of this limitation?)