Vendored libraries (no CDN: the shop's own server sends every file).

model-viewer/model-viewer.min.js     Google <model-viewer> 4.4.0, Apache-2.0 (LICENSE-model-viewer-Apache-2.0.txt). Includes three.js (MIT).
                                     https://github.com/google/model-viewer  (npm: @google/model-viewer@4.4.0, dist/model-viewer.min.js, unmodified)
draco/draco_decoder.{js,wasm}, draco_wasm_wrapper.js
                                     Google Draco decoders for glTF, Apache-2.0 (LICENSE-draco-Apache-2.0.txt).
                                     https://github.com/google/draco  (from three@0.175.0, examples/jsm/libs/draco/gltf, unmodified)
meshopt/meshopt_decoder.js           meshoptimizer 0.25 decoder, MIT (LICENSE-meshoptimizer-MIT.md).
                                     https://github.com/zeux/meshoptimizer  (npm: meshoptimizer@0.25.0, meshopt_decoder.js, unmodified)

model-viewer's defaults point the Draco and Meshopt decoders at Google's and jsDelivr's servers. viewer.js and box.js set
ModelViewerElement.dracoDecoderLocation and meshoptDecoderLocation to the files here before a model loads, so a shopper's browser
never calls another server. KTX2 / Basis textures are not supported (uploads that need them are refused).
