fix: upgrade vimeo-video-element to 1.7.2 to support referrer policy (fixes #2029)

[tonynguyenit18]

Summary

• Upgrades vimeo-video-element from ^1.6.1 to ^1.7.2
• Fixes Doesn't support Vimeo with whitelist domain #2029 — Vimeo videos with domain-level privacy (whitelist) settings failing with "Sorry. Because of its privacy settings, this video cannot be played here."

Root cause

When a page sets a restrictive referrer policy (e.g. <meta name="referrer" content="no-referrer">), the browser omits the origin from requests. Vimeo's domain-whitelist check then rejects the embed because it can't verify the referring domain.

The fix lives upstream in vimeo-video-element: PR muxinc/media-elements#209 added a referrerpolicy prop that is applied directly to the underlying iframe. This was released in vimeo-video-element@1.7.1 / 1.7.2 (see muxinc/media-elements#207).

Usage (after this fix)

Users experiencing domain-whitelist errors can now pass:

<ReactPlayer
  url="https://vimeo.com/123456789"
  config={{
    vimeo: {
      referrerpolicy: 'strict-origin-when-cross-origin'
    }
  }}
/>

The referrerpolicy prop is fully typed via VimeoVideoElement['config'] — no type definition changes needed in react-player itself.

Test plan

• npm install resolves to vimeo-video-element@1.7.2 with no peer-dependency conflicts
• npm run build (TypeScript + ESM) passes cleanly
• npm test — existing failures are pre-existing Node 24 / navigator getter incompatibility, unrelated to this change (reproducible on master without this diff)