For ExternalUrl module items, the Canvas API returns url=null and
html_url=.../module_item_redirect/<id>. We were passing item.URL (empty)
causing the session_token call to return no session_url.
The Canvas app authenticates ExternalUrl items via:
GET session_token?return_to=<module_item_redirect>?display=borderless
→ GET session_url → OAuth2 confirm
→ POST /login/oauth2/accept
→ Panopto Login.aspx?code= → CookieCheck.aspx (sets Panopto cookies)
Our previous code used sessionless_launch (the course-level Panopto tool)
for direct Panopto links, which gave wrong/incomplete Panopto cookies.
Added DownloadExternalPanoptoURL() that replicates the exact app flow.
Falls back to DownloadVideo if no Panopto cookies are obtained.
Both List.aspx (folder playlists) and Viewer.aspx (single videos) are
handled with the correct yt-dlp flags and output templates.
