[ryscript9]

Fixes #2007

Problem

In v3, hiding the native download, playback-speed, and picture-in-picture controls stopped working.

controlsList and disablePictureInPicture are already valid props, but Player copies an explicit attribute list onto the active player and these two were missing. pip={false} does not hide that button. It requests picture-in-picture mode.

The v2 path broke as well. config.file.attributes is now config.html.attributes, and HtmlPlayer spread that object onto the <video> / <audio> element, which rendered config="[object Object]" instead of applying the attributes.

Changes

• Forward controlsList and disablePictureInPicture, the same way playsInline and disableRemotePlayback already are.
• Apply config.html.attributes on the underlying media element. An explicit prop wins, including an explicit false. An omitted prop no longer wipes the same key.
• Keep the config object itself off the element.
• Document both props, and the v2 config.file.attributes → config.html.attributes path.
• Add a "Hide download, speed and PiP" checkbox to the demo.

Video

before/after, 32s

The same <ReactPlayer controls config={{ html: { attributes: { controlsList: "nodownload noplaybackrate", disablePictureInPicture: true } } }} /> on v3.4.0 and on this branch. On v3.4.0 the rendered <video> has no controlsList or disablePictureInPicture, gets config="[object Object]", and the overflow menu (download, playback speed, picture-in-picture) stays. With this PR both attributes are set, the config attribute is gone, and the overflow button disappears.

How I tested it

• Demo, Chrome. Loaded the mp4 and turned native controls on. Ticking the new "Hide download, speed and PiP" checkbox sets controlsList and disablePictureInPicture on the <video> and removes those overflow menu items. Unticking it removes them again. On v3.4.0 the same checkbox has no effect.
• Tests through ReactPlayer. The props land on <video>. config.html.attributes lands on <video> and <audio>. config is not a DOM prop. An explicit prop, including false, overrides config. These tests fail on master.
• Full local suite passed, 0 failed. npm run types and npx biome lint ./src are clean.

On Windows, npm test does not run as-is. The script globs are not expanded by cmd.exe, and echo '{"type": "module"}' writes quotes into disttest/package.json. I ran the same tester files from bash and fixed that file by hand. I left the test script alone because it is unrelated to this PR.

Not in this PR

• No dist/ changes, per CONTRIBUTING.md.
• No poster forwarding. fix: pass poster prop to internal component #2027 and fix: forward poster to video element #2045 already cover it.