* AG-17406-allow-updating-col-def-without-losing-ui-state

* AG-17134 Allow OneTrust, ZoomInfo blob + GA4 regional in grid CSP (#13968)

Port of charts PRs #7018 + #7021 to the grid root policy. www.ag-grid.com
uses a single www-wide GTM container, so grid root pages fire the same
production-only tags charts did:

- OneTrust cookie-consent SDK (GTM-injected): cdn.cookielaw.org in script-src;
  cdn.cookielaw.org + *.onetrust.com in connect-src.
- ZoomInfo zi-tag.js bootstraps a blob: URL script: blob: in script-src.
- GA4 geo-routed regional collect endpoint: www.google-analytics.com ->
  *.google-analytics.com in connect-src.

* AG-17134 Allow ecommerce checkout origins (Firebase Auth + Realex) in grid CSP (#13970)

The grid ecommerce/license checkout surfaced report-only violations on prod:

- Firebase Auth (anonymous sign-in during checkout) XHR to
  www.googleapis.com/identitytoolkit + securetoken.googleapis.com (ID-token
  refresh) -> connect-src.
- Realex / Global Payments Hosted Payment Page (rxp-hpp.js) rendered as an
  iframe and the payment form POSTed to it -> frame-src + form-action.
  Env-split (mirrors the trial-form pattern): pay.sandbox.realexpayments.com
  in dev/staging, pay.realexpayments.com in production.

* AG-17134 Allow GA analytics.js in script-src (post-consent) (#13979)

After accepting cookies in the OneTrust banner, GTM injects Universal
Analytics, which loads https://www.google-analytics.com/analytics.js as a
script. script-src did not list that host (only connect-src had the
*.google-analytics.com wildcard for the collect XHRs), so it reported a
script-src violation. Add https://www.google-analytics.com to script-src.

Consent-gated + GTM-injected, so prod-only — staging never fired it.