Summary

This PR addresses on of our longer standing and more pressing issues: built-in AMP sanitization and optimization for stories. See this doc for reference.

How it works:

• The relevant parts of the AMP plugin are included as a composer dependency
• Our main rendered class, HTML.php, calls the new Sanitization and Optimization classes which do the respective jobs.
• The logic of these classes is mostly copied from AMP_Theme_Support
• Custom sanitizers are added on top of (or in replacement of) existing sanitizers

Relevant Technical Choices

• Includes the AMP WordPress plugin as a composer dependency
  • Prevents the plugin's file autoloader from running using mcaskill/composer-exclude-files, to avoid loading any procedural code by the AMP plugin.
    For one because they'd otherwise cause conflicts if functions are already defined. But also because they often cause side-effects like accessing options from the database, or requiring AMP__VERSION to be set.
  • PHP-CSS-Parser patches have been copied for the time being, as there seems to be a need to fix paths to patches in the amp-wp repo. See Local patch could not be downloaded for dependencies cweagans/composer-patches#315 for the actual issue occurring here.
• Uses classes provided by the plugin to construct a DOMDocument
  • This drastically reduces the size of the HTML class and removes duplicate logic.
• Copies chunks of AMP_Theme_Support to Sanitization to run markup through sanitization and optimization.

Meta_Sanitizer

A shameless copy of AMP_Meta_Sanitizer, except that it does not call amp_get_boilerplate_stylesheets(). As mentioned above, we're not loading that function.

• Contribute this upstream

Canonical_Sanitizer (#4193)

Enforces adding a link[rel=canonical] to documents to make sure they are always valid.

The AMP plugin itself does that already in \AMP_Theme_Support::ensure_required_markup(). We just do the same here.

This sanitizer is only used when the AMP plugin is not active. It could be easily contributed to the AMP plugin, too.

• Contribute this upstream

Story_Sanitizer

This new sanitizer was extracted from the HTML class, and currently deals with setting publisher logos and poster images. Also removes the amp attribute from the document if either is missing.

• Ensure this also works well when the AMP plugin is used.

Related: #4762

Avoiding Conflicts

See #4543 for how we're avoiding conflicts with the AMP plugin itself (or any other plugin using the same libraries) by prefixing them before shipping.

To-do

Not in the scope of this PR, but tasks to look at soon after.

• Enable transient caching in AMP_Style_Sanitizer
  Currently disabled because add_poster_images calls AMP_Options_Manager, which in turn requires AMP__VERSION to be defined. The method is private, so can't be overridden in an extended class.
  Aside: CSS used in stories is usually rather small, so not sure transient caching is actually needed
• Load packages from Packagist once available.
• Contribute upstream changes where necessary / desirable
• Find workaround for Local patch could not be downloaded for dependencies cweagans/composer-patches#315

User-facing changes

Web Stories are sanitized and optimized by default, even when the AMP plugin is not active.

Testing Instructions

1. Check out this branch and run composer install or check out this branch on the QA site
2. Publish a story, don't set a poster
3. Add some analytics ID in the settings
4. Maybe add some plugin that adds some invalid markup
5. Verify it's still valid AMP

Fixes #4650
Fixes #4193