fix BS-3606
#### PR Dependency Tree
* **PR #12892**
* **PR #12895** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced support for embedding generic iframes with customizable
dimensions and permissions, while ensuring only secure, non-AFFiNE URLs
are allowed.
* Enhanced embedding options by prioritizing custom embed blocks over
iframe blocks for a richer embedding experience across toolbars and link
actions.
* Added URL validation to support secure and flexible embedding
configurations.
* **Bug Fixes**
* Improved iframe embedding reliability by removing restrictive HTTP
headers and certain Content Security Policy directives that could block
iframe usage in the Electron app.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Close
[BS-3251](https://linear.app/affine-design/issue/BS-3251/正文的inline链接，chrome中，中键开新窗口的行为丢失了)
#### PR Dependency Tree
* **PR #12902** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Middle-clicking on links and references now opens them in a new
browser tab.
- Linux platform detection has been added for improved
environment-specific behavior.
- **Bug Fixes**
- Middle-click paste prevention is now limited to Linux environments
when the relevant setting is disabled and excludes clicks on links and
references.
- **Tests**
- Added end-to-end tests to verify that middle-clicking links opens them
in a new tab for external links, internal links, and reference
documents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: [BS-3291](https://linear.app/affine-design/issue/BS-3291/工具栏展开时报错，链接无法点击打开)
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
- **New Features**
- URLs entered without a protocol (e.g., "github.com/...") are now automatically normalized to use "https://", ensuring links are secure and consistently formatted.
- **Bug Fixes**
- Improved handling and validation of links to prevent issues with missing or invalid protocols in bookmarks and inline links.
- Simplified URL validation logic by leveraging native URL parsing, removing complex regex and email-specific checks.
- Streamlined toolbar link actions to operate only on valid normalized URLs.
- Refined URL detection in markdown preprocessing to exclude lines containing spaces from being treated as URLs.
- **Tests**
- Added tests to verify that links without a protocol are correctly normalized and displayed across different views.
- Updated URL validation tests to better reflect valid and invalid URL formats, including IP addresses and domain variants.
- **Style**
- Updated snapshots to reflect the use of "https://" in links.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Peng Xiao