feat: inject WGU PingFed session keepalive script via config

[j0mc]

Overview

Loads the WGU PingFed SSO session keepalive script into the MFE via a new SESSION_KEEPALIVE_SCRIPT_URL MFE config value. The script itself is served by the LMS (academy-oedx-plugin → wgu_session_keepalive view) and is not bundled here.

This approach means keepalive behavior, timings, and copy can be updated via a plugin deploy without requiring an MFE rebuild, and the legacy LMS pages run byte-identical code.

The script tag uses defer (rather than async) because the script mounts a modal into document.body and reads localStorage on startup — it needs a parsed document, but is small enough that it never blocks first paint.

When SESSION_KEEPALIVE_SCRIPT_URL is empty or unset (the LMS publishes an empty string when the feature is disabled), the tag renders nothing, so environments that haven't enabled the feature are unaffected.

To test:

1. Enable the keepalive feature in the LMS site config (SESSION_KEEPALIVE_SCRIPT_URL pointing to the keepalive script endpoint).
2. Load a course page in the MFE and confirm the keepalive modal appears as expected.
3. With the config value empty/unset, confirm no script tag is injected and no errors appear in the console.

Checklist

• Code is correctly formatted and linted
• Unit tests are updated and are passing
• PR title follows conventional commits (https://www.conventionalcommits.org/en/v1.0.0/#summary)
• PR Title aligns to Semantic-Release supported prefixes
• Check for unused files
• Check work before asking for reviewers
• Fix any linting errors
• SECURITY: No secrets were committed to the repo
• COMPLIANCE: Committed code is not proprietary and adheres to Open Source licensing