Fix WordPress.org compliance issues

[bwstefano]

Summary

• document third-party and external services for WordPress.org review
• tighten escaping, sanitization, and embed rendering paths
• remove avoidable remote asset dependencies and add compliance regression checks
• restore editor behaviors affected during the compliance pass, including search UX, legends, embeds, and translations

Context

This PR is intentionally stacked on top of codex/i18n-string-review and should be reviewed after that PR.

The goal here is to address the WordPress.org review concerns around:

• undocumented use of third-party or external services
• variables and options that must be escaped when echoed
• avoiding direct cURL usage and preventing regressions in transport/compliance rules

What Changed

Third-party services and privacy

• added a dedicated third-party services section to the plugin readme
• added privacy policy content for services used by the plugin
• clarified admin-facing disclosures for Mapbox and Nominatim usage

Remote dependencies and compliance hardening

• removed avoidable remote glyph and marker asset dependencies
• replaced editor marker assets with local plugin assets
• kept user-configurable typography/logo URLs while documenting and sanitizing them appropriately
• added automated compliance checks for banned patterns and required documentation
• added a post-build compliance patch step for generated assets

Escaping, sanitization, and rendering

• tightened contextual escaping in settings, embeds, and map rendering
• normalized settings sanitization for typed values and asset URLs
• hardened embed output and logo sizing for large images

Geocoding and editor behavior

• changed Nominatim lookups to explicit user-triggered search behavior
• added caching on the geocoder side
• fixed repeated search behavior without saving
• fixed search field/button alignment issues in storymaps and post geolocation
• restored Enter-triggered address search
• prevented premature “no results” messaging

Legends and translations

• restored legend rendering for incomplete/legacy legend metadata paths
• aligned legend script registration with editor and frontend dependencies
• normalized Discovery so the action remains Embed in both Portuguese and Spanish, while keeping translated wording in other contexts
• updated new and edited strings in pt_BR and es_CO

Validation

• npm run check:env
• npm run build
• npm run build:report
• npm run test:unit
• composer validate --no-check-publish
• vendor/bin/phpcs --standard=phpcs.xml.dist
• php scripts/check-php-compat.php
• WordPress smoke test on WordPress 6.9.4 with PHP 8.4

Notes

• local wp-cli still emits deprecation warnings during i18n:json, but the build completes successfully and the warnings come from the toolchain, not plugin runtime
• the mapBlocks bundle budget was updated to reflect the current stable CKEditor footprint used by the storymap editor