Add Google Tag Manager first-party integration

[prk-Jr]

Scripts like GTM and GA4 are often blocked by ad blockers or privacy extensions when loaded from third-party domains, leading to data loss. Third-party cookie deprecation further limits tracking durability.

This change transparently proxies GTM/GA4 scripts and analytics beacons through the Trusted Server, establishing a first-party context. It automatically rewrites HTML tags (including <link rel="preload">) and script content to point to local proxy endpoints, bypassing blockers and extending cookie life.

Includes:

• Proxy endpoints for gtm.js, gtag/js, /collect, and /g/collect with configurable caching and strict validation
• Server-side HTML rewriting for src and href attributes targeting GTM/GA domains
• Server-side script content rewriting to redirect internal GTM/GA calls through the proxy
• Client-side script guard (DOM interception) for dynamically inserted scripts on Next.js and SPA sites
• Privacy enhancement: client IP addresses are not forwarded to Google (Google sees only the edge server IP)
• Regex hardened against subdomain spoofing (e.g., www.googletagmanager.com.evil.com)
• Comprehensive testing: 18 unit/integration tests covering configuration, URL rewriting, HTML pipeline, header validation, and IP stripping

Manual Test Plan

Prerequisites: Configure .env with GTM enabled and a valid container ID, then start the local server.

1. Script proxy — gtm.js rewritten

curl -s 'http://127.0.0.1:7676/integrations/google_tag_manager/gtm.js?id=GTM-522ZT3X6' \
  | grep -c '/integrations/google_tag_manager'

Expected: count > 0

2. Script proxy — gtag/js returns 200

curl -s -o /dev/null -w '%{http_code}' \
  'http://127.0.0.1:7676/integrations/google_tag_manager/gtag/js?id=G-DQMZGMPHXN'

Expected: 200

3. gtag/js content rewritten (no Google domains)

curl -s 'http://127.0.0.1:7676/integrations/google_tag_manager/gtag/js?id=G-DQMZGMPHXN' \
  | grep -c 'www.google-analytics.com'

Expected: 0

4. Beacon proxy — POST /g/collect

curl -s -o /dev/null -w '%{http_code}' -X POST \
  'http://127.0.0.1:7676/integrations/google_tag_manager/g/collect?v=2&tid=G-TEST&cid=123&en=page_view' \
  -d 'v=2&tid=G-TEST'

Expected: 204 or 200

5. Beacon proxy — GET /collect

curl -s -o /dev/null -w '%{http_code}' \
  'http://127.0.0.1:7676/integrations/google_tag_manager/collect?v=2&tid=G-TEST'

Expected: 204 or 200

6. Cache headers present

curl -sI 'http://127.0.0.1:7676/integrations/google_tag_manager/gtm.js?id=GTM-522ZT3X6' \
  | grep -i cache-control

Expected: cache-control: public, max-age=900

Resolves: #224

[aram356]

🔧 Please make sure checks pass before assigning to review.

[aram356]

Good start. Need to address specific items and the following.

Duplicated rewrite logic across three places

The GTM URL rewriting logic exists in three separate methods: rewrite_gtm_script(), IntegrationAttributeRewriter::rewrite(), and IntegrationScriptRewriter::rewrite(). Each handles a slightly different set of patterns. This is error-prone — a new URL pattern needs to be added in multiple places.

[ChristianPavilonis]

For the re-writes to work with nextjs sites we need to use the scriptGuard pattern. Next sites can load the scripts dynamically after the fact so we catch and rewrite the script tags client side also.

see: https://github.com/IABTechLab/trusted-server/blob/main/crates/js/lib/src/integrations/permutive/script_guard.ts

[aram356]

@prk-Jr Please add (manual) test plan

[aram356]

Look good overall. I would like to see test plan and address script guard.

[aram356]

@prk-Jr Please deploy to staging for autoblog.com I did not see in the plan.