Revise native oembed_controller.js to handle Kaltura embeds

[rshiggin]

video test at umich-bhl-2014150_aspace_fbc9fce65eb1ba6a7a6d36f8f87e5af2

Inserts an iframe (div→iframe), which handles CORS by delegating loading/rendering to the browser as an isolated embedded document, rather than having your script read a cross-origin response. The browser loads Kaltura's player in its own separate origin context.

UPDATE: This PR also adds spacing and a light bar between each metadata section on class .al-show-sub-heading (e.g., Online Content, Using These Materials).

[rshiggin]

Refactored version

1. connect() split into dispatcher logic

• Original: all Kaltura parsing/embedding inline in connect().
• Refactored: connect() now delegates — calls findKalturaEntryId(), and if found calls loadKalturaEmbed(); otherwise falls back to a new loadOEmbed() path.

2. New entry-ID parsing method: findKalturaEntryId()

• Uses the URL API with try/catch to safely handle invalid URLs (previously a raw regex on urlValue with no validation).
• Restricts embedding to Kaltura hosts (kaltura.com / .kaltura.com).
• Reads entry_id from query params first, validated against a new ENTRY_ID_PATTERN constant (line 6), then falls back to a path-based regex match.

3. New method: loadKalturaEmbed(entryId)

• Guards on a missing .al-digital-object container (warns and returns) instead of silently no-op via optional chaining.
• Builds query string with URLSearchParams instead of manual string concatenation.
• Trims the link title text (?.trim()).

4. New oEmbed fallback: loadOEmbed() + findOEmbedEndpoint()

• Entirely new capability: fetches the URL, discovers the application/json+oembed in the document head, fetches the endpoint, and injects returned html.
• The original controller had no true oEmbed handling — it only did Kaltura iframe embedding.

5. Constants

• Added ENTRY_ID_PATTERN regex constant for reusable, anchored validation.

[rshiggin]

Two other branch make changes to app/assets/stylesheets/_contents.scss. Hold off on rebasing.