Fix experimental native embedding and remove VITE_APP_URL

[PhilReinking]

I changed the way the server url is passed to the classic form script. Before it was necessary that the server url is available on build time. Due to some changes this haven't been the case for a longer period at all.

Since self-hosted instances have different urls, the server url needs to be somehow passed to the script. This is now done in two ways:

1. If the form is requested through a normal page view, we use the window location (aka server url)
2. If the form is embedded in a different page, we pass down the server url through the embed script data attributes (data-server-url)

I also added a new middleware for some routes which were previously unprotected if a form was unpublished.

Also the embedded form show now a 404 state instead of an error, when the form is not fetchable.