fix(youtube-player): use safevalues

[andrewseguin]

Use Google's safevalues package to avoid casting to any for the url in the youtube player

[crisbeto]

Overall LGTM, although I don't quite follow why we want the dependency when the URL is hardcoded.

[andrewseguin]

This was going to be added to remove the any cast, but it looks like it might just work out of the box. This is probably.not necessary

Some context: #30613

[jamOne-]

Hello! I tried simply hardcoding the url with script.src = url, but then a tsec unit tests fails with ban-script-src-assignments check and I wanted to resolve that.

I do not fully understand why this assignment is risky without the safevalues package, I just trusted the check. Maybe it's wrong and we should just remain the (script as any).src assignment. WDYT?

[crisbeto]

My understanding is that the tsec check uses the type checker to find if the variable has a src property and prevents any strings from being written to it. We can either leave it as is or rewrite the code in a way where tsec can't analyze it.