feat: convert iframe block to dynamic server-side rendering

[firestar300]

This refactors the blockparty-iframe block to use a server-side render_callback via the new BlockRenderer class.

This approach ensures the iframe HTML is always generated on the server, providing greater control over attributes, sanitization, and future extensibility. Existing blocks will continue to render correctly due to the added deprecated save function.

---

Note

Medium Risk
Front-end iframe HTML now comes from PHP instead of saved block markup; behavior should match via deprecated save, but embed URL/attribute handling is security-relevant and worth regression-testing on existing content.

Overview
The iframe block no longer serializes markup in the editor save path; front output is produced by a PHP render_callback (BlockRenderer::render) registered from the main plugin bootstrap, with i18n loading folded into the same init hook.

BlockRenderer builds the wrapper and <iframe> from block attributes (url, title, lazyload, custom iframeAttributes), escapes core fields, skips a fixed denylist for custom keys, and handles boolean iframe attributes. Missing URL or title yields an empty wrapped div.

The previous save implementation is kept only under a deprecated block definition so existing post content keeps validating while new saves are dynamic. Block registration is simplified to a single register_block_type on build/blockparty-iframe instead of the WordPress 6.7/6.8 blocks-manifest collection helpers.

Composer gains PSR-4 autoload for Blockparty\Iframe\ → includes/, pins some dev tools, and composer.lock is gitignored. PHPCS now scans includes/; npm wp-env scripts are renamed to env:start / env:stop.

^{Reviewed by Cursor Bugbot for commit a8ceb14. Bugbot is set up for automated code reviews on this repo. Configure here.}