DRM Policy: Add pixels

[0nko]

Task/Issue URL: https://app.asana.com/1/137249556945/project/1207418217763355/task/1217678542848175?focus=true
Tech Design URL (if applicable): https://app.asana.com/1/137249556945/project/1207418217763355/task/1216952383692269?focus=true

Description

This PR adds a pixel to measure the auto-approved DRM permissions.

Steps to test this PR

Setup

Test privacy config URL: https://gist.githubusercontent.com/0nko/6ba6564e43ec35095a08c0e2288bbdde/raw/3eb9c38d461e73739ebc0d84f7c352cb9d7082d1/privacyconfig.json ("foxnews.com" in eme and "reference.dashif.org" in emeBlock)

Pixel fires for an allow-list grant (test config)

• Open https://www.foxnews.com/video
• Verify the decision log shows action=GRANT, reason=ALLOW_LIST
• Verify a pixel is sent: Pixel sent: m_site_permissions_auto_granted with params: {type=drm, reason=allow_list}

Pixel fires for a protections-off grant (test config)

• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html and confirm reason=BLOCK_LIST
• Open the privacy dashboard (shield) and switch Protections OFF
• Force-stop and reopen the app, reload the page
• Verify action=GRANT, reason=PROTECTIONS_OFF and Pixel sent: m_site_permissions_auto_granted with params: {type=drm, reason=protections_off}

No pixel for user-driven grants

• Turn protections back on
• Go to "cnn.com" and open a video article
• Choose Allow with "Remember my choice" in the DRM dialog
• Reload and verify action=GRANT, reason=USER_ALLOW_ALWAYS
• Verify no m_site_permissions_auto_granted pixel is sent — the user made this choice, it is not an automatic grant

---

Note

Low Risk
Telemetry and feature-flag default/annotation tweaks only; DRM grant behavior is unchanged.

Overview
Adds m_site_permissions_auto_granted so DRM grants from the central policy (allow-list or protections-off) can be compared with dialog impressions.

The pixel fires once per tab/domain via DrmSessionStore.markAutoGrantReported. User-driven grants (USER_ALLOW_ALWAYS) and non-GRANT decisions are not counted.

Also switches drmPolicy / centralPolicy to @InternalAlwaysEnabled with a default of FALSE.

^{Reviewed by Cursor Bugbot for commit dee4427. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Privacy Review task: https://app.asana.com/0/69071770703008/1217701699737477

[anikiki]

Looks good, I'll approve, but check this https://app.asana.com/1/137249556945/task/1217678542848175/comment/1217730625247666?focus=true