Improve authentication inside the mobile apps

When a user is logged in to the mobile apps with their WordPress.com account, we don't have a good way to authenticate a web view for the site, as we don't have the site's password or cookies. We can leverage SSO if it’s enabled, but we need to know beforehand if that’s the case.

The most important case to cover is the customizer. Users should be able to use it from the apps, but we need to authenticate to make it possible.
Another commonly reported issue is that since the "View Site" option is not authenticated, all the views are counted in stats.

We could consider force-enabling SSO(*) for certain actions inside the apps, or another solution similar to the `frame-nonce` we have for previews.

(*) After evaluating security implications. I still haven't thought much about this path, and it might be a terrible idea.

The issue names no files or tests. Begin by tracing authentication for the mobile apps' customizer and View Site flows, then review the existing SSO and frame-nonce approaches mentioned in the report. Done means users can use the customizer while authenticated, and View Site requests do not inflate site statistics.

Written by the indexing model from the issue text.