Marketplace plugin card details are blocked by CSP on self-hosted instances

### Self Checks

- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
- [x] Please do not modify this template :) and fill in all the required fields.

### Dify version

The exact version of the affected deployment was not recorded.

Source reviewed for the proposed fix: upstream `main` at `318964e4dc10ad836ac8ab88d280377b83f7e7a1` (`web/package.json`: `1.17.1`). This is the patch baseline, not a verified version of the affected deployment.

### Cloud or Self Hosted

Self Hosted. The original report did not record whether the deployment uses Docker images or runs directly from source.

### Steps to reproduce

1. Open a self-hosted Dify console on a custom domain and navigate to Marketplace.
2. In the plugin list, click a plugin card, for example `mosoo-ai/mosoo`.
3. Observe the embedded detail dialog and the browser console.
4. Close the dialog and click the card's **Details** action. The same failure occurs.

The affected console uses the `zh-Hans` UI locale. The browser name and version were not recorded.

### ✔️ Expected Behavior

Both the plugin card and its **Details** action should provide access to usable plugin details on a self-hosted instance.

### ❌ Actual Behavior

The detail dialog opens, but the browser refuses to display the Marketplace page in its iframe because the self-hosted console origin is not permitted by the Marketplace response's Content Security Policy `frame-ancestors` directive.

Reported browser error (the console domain in `source` is anonymized):

```text
Refused to load https://marketplace.dify.ai/plugin/mosoo-ai/mosoo?canInstall=true&installed=false&language=zh-Hans&source=https%3A%2F%2Fconsole.example.com&theme=light&view=modal because it does not appear in the frame-ancestors directive of the Content Security Policy.
```

The proposed fix is to open the full Marketplace detail page in a new tab for self-hosted Community and Enterprise plugin-list cards and their **Details** actions, while preserving the embedded dialog for Cloud. Top-level navigation does not require the self-hosted console to be an allowed frame ancestor. The card's separate **Install** action would retain its existing console installation flow.

I have prepared a focused fix and would like to take this issue. Its scope is the shared plugin-list card and its **Details** action; other Marketplace detail entry points are outside this patch.

Start in the web package, using web/package.json as the stated source baseline, and locate the shared plugin-list card plus its Details action. Trace their Marketplace detail navigation for Cloud, Community, and Enterprise. Done means self-hosted cards open the full Marketplace detail page in a new tab, Cloud retains the embedded dialog, and Install keeps its existing flow.

Written by the indexing model from the issue text.