wip

[vlymar]

Changes

• Replaces mozilla's domains with our own in the HOSTED_VIEWER_ORIGINS whitelist.
  • this whitelist allows us to make cross origin requests for files (i.e. to s3).
  • Allow foriegn origin URLs only for hosted viewers. mozilla/pdf.js#6916 is a summary of why this whitelist exists
• Renames main engine controller from PdfjsViewer::ApplicationController to PdfjsViewer::PdfApplicationController to prevent namespace collisions with our main app's ApplicationController
• Allows the engine routes to be embedded as iframes only under our base url
  • implemented with a combination of X-Frame-Options and Content-Security-Policy headers
• Restricts the domains that files will be loaded from to a whitelist
• Viewer can only be loaded in an iframe

[drusepth]

This looks awesome. No changes from me.

[drusepth]

It'd be pretty cool to just include this in production and the previous line in dev/staging, but definitely not necessary. I'm not sure how we'd even do that well if this is sitting in a separate gem, though.

[vlymar]

I decided to avoid dealing with injecting configuration into this file. The less we change this file, the easier it will be to pull in upstream updates from the pdf.js repo.