ga: convert to "tag manager"

There have been two generations of GA since we first implemented GA on
the website. The newest version allows us to get deeper insights while
collecting less personal data. This version is also faster and loads
async which should help load the &os; website on slower networks.

As a reminder: to opt out do ANY of the following:
- block google.com via an adblocker
- set (abuse) the "do not track" header

In addition we've selected to disable many features in the console that
would result in collecting more data.

With Hat:	webstats@

share/xml/header.ent

@@ -21,10 +21,33 @@
 
 <!-- Standard headers and footers -->
 
+<!--
+  Owned by webstats@
+  Check that the hosting domain is actually a FreeBSD.org domain, so
+  we do not accidentally obtain data from mirrors.
+ -->
 <![%html.header.script.google;[
-<!ENTITY header1.googlejs '<script xmlns="http://www.w3.org/1999/xhtml" type="text/javascript" src="&enbase;/layout/js/google.js"></script>'>
+<!ENTITY header1.googlejs "
+<script xmlns='http://www.w3.org/1999/xhtml'> 
+var allow_track = true; var h = document.location.hostname;
+var fbsdregex = /((docs|security|svnweb|wiki|www)\.freebsd\.org|google\.com)$/i;
+
+if (typeof navigator.doNotTrack !== 'undefined' &amp;&amp; (navigator.doNotTrack == '1')) {
+	allow_track = false;
+}
+if (allow_track &amp;&amp; fbsdregex.test(h)) {
+(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+j=d.createElement(s),dl=l!='dataLayer'?'&amp;l='+l:'';j.async=true;j.src=
+'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+})(window,document,'script','dataLayer','GTM-PXRWZVR');}
+</script>">
+<!ENTITY header1.googleiframe '
+<noscript xmlns="http://www.w3.org/1999/xhtml"><iframe xmlns="http://www.w3.org/1999/xhtml" src="https://www.googletagmanager.com/ns.html?id=GTM-PXRWZVR" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+'>
 ]]>
 <!ENTITY header1.googlejs ''>
+<!ENTITY header1.googleiframe ''>
 
 <!ENTITY header2.logo-red.label '<h2 xmlns="http://www.w3.org/1999/xhtml" class="blockhide">Header And Logo</h2>'>