Don't register WebM / MSE-AVF media players for GPU-process playback under MediaContainment
WebKit splits media across the WebContent process (JS, demuxing), the GPU process (decoding, rendering), and a WebContent-side remote proxy (MediaPlayerPrivateRemote). When MediaContainment is enabled, WebM and MSE-AVF engines demux in WebContent and only the renderer lives in GPU, so instantiating the full MediaPlayerPrivate in GPU is both unnecessary and a defense-in-depth gap. Previously a single MESSAGE_CHECK in createMediaPlayer was the explicit IPC guard rejecting those instantiations; codec capability queries (canDecodeExtendedType) shared the same engine registry with no way to distinguish "can answer queries" from "can be instantiated for playback".
Source/WebCore/platform/graphics/MediaPlayerEnums.h
Source/WebKit/GPUProcess/media/RemoteMediaPlayerManagerProxy.cpp
This commit replaces the hand-maintained allowlist with registry-based scope filtering. Each MediaPlayerPrivate now declares its own MediaPlayerScope (Playback vs Supports), and a new playbackEngineForConnection helper filters all GPU-process engine lookups by scope and MediaContainmentEnabled state, preventing WebM and MSE-AVF engines from being instantiated for GPU playback when MediaContainment is active while still letting them answer codec queries.
Significance
This restructures a GPU-process privilege boundary: the explicit MESSAGE_CHECK IPC guard is gone, replaced by an implicit registry contract that must be upheld correctly at every call site — a larger and more subtle attack surface.