Add an own-HTML block, and build the DEEG offers page on the embed block

Umut asked for a block that takes custom HTML, and for an iframe on a new
DEEG offers page. Only one of those was missing.

New core block "Eigenes HTML" (document schema v24): one property, the
markup, up to 20.000 characters, written to the page unchanged. Changing it
is reserved for administrators and compared against what is stored - on
saving, on saving an area, and on restoring an older revision - exactly like
an own script. <script> and <iframe> are refused with the way to the right
place instead of being swallowed by the content security policy: scripts
belong in the script field, frames in the "Externer Inhalt" block, because
only that one asks for consent and puts the host into frame-src (ADR 106).

DEEG: /angebote existed as a draft with placeholder text. It is now built
like the legal pages - small caps line, large light heading, lead on the
tinted band - with the IS24 result list below it and a line pointing to the
portal and to the contact form. Navigation and the offers band on the home
page point there. The consent question is switched on, so the frame loads
only after the visitor agrees, and both the banner and the placeholder carry
the site's own shapes and colours.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Content/CustomCode.php

@@ -5,15 +5,23 @@ namespace App\Content;
 use App\Domain\InvalidDocument;
 
 /**
- * Own CSS and own script per element (document schema v13).
+ * Own CSS and own script per element (document schema v13), and the raw HTML of the „Eigenes
+ * HTML“ block (schema v24).
  *
- * The two are not comparable in what they can do, so they are not treated alike.
+ * The three are not comparable in what they can do, so they are not treated alike.
  *
  * **CSS** is parsed and written out again by this class, scoped to the block. A declaration list
  * and nested rules starting with `&` are accepted; anything else is refused. Because the output is
  * re-serialised, a stray `}` cannot escape the block, and `@import` or a `javascript:` URL never
  * gets through. Everyone with the editor role may use it.
  *
+ * **HTML** is markup that goes onto the page unchanged. It cannot be made harmless either - it
+ * can load images from anywhere and point a form at a foreign address - so it follows the same
+ * rule as a script: administrators only, checked against what is already stored. Two tags are
+ * refused rather than silently swallowed by the content security policy: `<script>`, which
+ * belongs in the script field, and `<iframe>`, which belongs in the „Externer Inhalt“ block,
+ * because only that one asks for consent and puts the host into `frame-src`.
+ *
  * **Script** is arbitrary JavaScript on the published site. There is no way to make that harmless:
  * whoever may set it can run code in the browser of every visitor and every administrator. It is
  * therefore reserved for administrators, checked on the way in by comparing against what is
@@ -24,6 +32,7 @@ final class CustomCode
 {
     public const MAX_CSS = 4000;
     public const MAX_SCRIPT = 8000;
+    public const MAX_HTML = 20000;
 
     public static function supports(mixed $schemaVersion): bool
     {
@@ -62,6 +71,66 @@ final class CustomCode
         return $script;
     }
 
+    /**
+     * Checks the markup of an „Eigenes HTML“ block and returns it unchanged.
+     *
+     * @throws InvalidDocument
+     */
+    public function checkHtml(string $html): string
+    {
+        if (mb_strlen($html) > self::MAX_HTML) {
+            throw new InvalidDocument(sprintf('Eigenes HTML ist auf %d Zeichen begrenzt.', self::MAX_HTML));
+        }
+        // Beide Tags wuerden von der Sicherheitsrichtlinie der Seite ohnehin nicht ausgefuehrt
+        // bzw. nicht geladen. Eine Meldung mit dem richtigen Weg ist besser als ein Baustein,
+        // der etwas annimmt und nachher nichts tut.
+        if (1 === preg_match('/<\s*script/i', $html)) {
+            throw new InvalidDocument('Eigenes HTML führt keine Skripte aus. Dafür gibt es unter „Erweitert“ das Feld „Eigenes Skript“.');
+        }
+        if (1 === preg_match('/<\s*iframe/i', $html)) {
+            throw new InvalidDocument('Für einen eingebetteten Rahmen gibt es den Baustein „Externer Inhalt“: nur er fragt vorher um Einwilligung und trägt den Anbieter in die Sicherheitsrichtlinie ein.');
+        }
+
+        return $html;
+    }
+
+    /**
+     * The raw HTML of every „Eigenes HTML“ block, keyed by block ID.
+     *
+     * @return array<string, string>
+     */
+    public function htmlOf(array $document): array
+    {
+        $found = [];
+        $walk = function (array $blocks) use (&$walk, &$found): void {
+            foreach ($blocks as $block) {
+                if ('html' === ($block['type'] ?? '') && is_string($block['props']['html'] ?? null) && is_string($block['id'] ?? null)) {
+                    $found[$block['id']] = $block['props']['html'];
+                }
+                $walk($block['children'] ?? []);
+            }
+        };
+        $walk($document['blocks'] ?? []);
+
+        return $found;
+    }
+
+    /**
+     * Refuses a write that would add, change or remove raw HTML without the administrator role.
+     *
+     * @throws InvalidDocument
+     */
+    public function assertHtmlUnchanged(array $incoming, array $stored): void
+    {
+        $before = $this->htmlOf($stored);
+        $after = $this->htmlOf($incoming);
+        ksort($before);
+        ksort($after);
+        if ($before !== $after) {
+            throw new InvalidDocument('Eigenes HTML darf nur von einem Administrator geändert werden. Die übrigen Änderungen wurden nicht gespeichert.');
+        }
+    }
+
     /**
      * Turns own CSS into rules scoped to one block.
      *