The amount of pain caused by HTML not having a "client-side include" is ridiculous. Server-side include is very old, but for various reasons having it client side would be easier for use cases like this.

(Security would have to be the same as <script>)