Fix widget preview and embed codes.

The existing widget embedding system relied on a few of assumptions:

* It always used HTTP, which results in a security policy issue, see: https://developer.mozilla.org/en-US/docs/Security/MixedContent
* It assumed that the `extern/embed.php` script was accessible on the web server via its absolute path
* That there is a file called `civicrm.config.php` three directories beneath `extern`.

This patch creates a CRM page instead of an external script that generates the embeddable JavaScript and uses the `crmURL` function to generate correct URLs according to the way the CiviCRM instance is configured.

This was tested on the FSF's development CiviCRM instance.