Add _gl parameter to Direct Booking Widget loader allowlist

Problem: The direct booking widget loader (widget-loader.prod.js) uses an allowlist for parameters forwarded to the booking iframe. The _gl parameter (used by GA4 for cross-domain tracking) is missing from this list.

Current Allowlist: checkin, checkout, adults, children, infants, pets, locale, source, utm_source, utm_medium, utm_campaign, utm_term, utm_content, theme.

Impact: This breaks session continuity for all customers embedding the widget on their own sites (e.g., WordPress, Squarespace). GA4 treats arrivals at booking.hospitable.com as new sessions (firing session_start and first_visit), resulting in bookings being logged as 'direct' with no source attribution.

Proposed Solution: Add _gl to the allowlist in the function that builds the iframe URL from the parent window’s query string.

Documentation Fix: Update the 'Direct Booking Flow Analytics' documentation to accurately reflect attribution behavior for the embedded widget, as the current guidance regarding cross-domain settings is ineffective without this code change.