JS advertisement type does not yet actually run the JS

We should also add an explicit permission to enter / edit the JS for security reasons.

As discussed with @anybody, I have moved all code related to the JS ad type into a separate submodule, and we will tackle the proposed solution there.

Merging current state so that we can then finish this in a follow-up branch.

@grevil: Since moving the configs over into the sub-submodule, the tests are broken - they worked before. Any idea? Maybe a config dependency we overlooked?