Sanitizer: resolve img/source srcset URLs and add a src fallback

[polybjorn]

FreshRSS drops srcset unless it is whitelisted, and even when allowed the URLs inside are never resolved, because replace_urls() only rewrites single-URL attributes. Relative srcset URLs leak, and lazy-loaded images (placeholder in src, real images in srcset) show only the placeholder.

This handles srcset in the allowed-node pass of Sanitize:

• Each srcset URL on <img> and <source> is resolved against the document base, and entries with a disallowed scheme are removed.
• On <img>, when src is empty or a placeholder (1x1 transparent GIF, or a data: URI under 128 chars), the smallest entry is copied into src as a fallback.
• Parsing follows the WHATWG srcset rules, so unencoded commas in URLs (Cloudinary, WordPress) do not split entries.

It only runs when a caller allows srcset through allowed_html_elements_with_attributes(), so default output is unchanged.

Ports the Sanitize change from FreshRSS/FreshRSS#8843, which currently patches the vendored copy of this file directly. Once this lands and the library is re-vendored, that PR keeps only its SimplePieCustom.php allowlist change.

Test plan

tests/Unit/SanitizeSrcsetTest.php adds 23 tests covering URL resolution, placeholder detection, fallback selection, comma-in-URL parsing, scheme blocking, HTTPS forcing, and <picture><source>. composer test, composer phpstan and composer cs pass, and the existing SanitizeTest is unchanged.

[Alkarex]

Please try to address the CI/CD failures if you can

[polybjorn]

Done. Three causes:

• Arrow functions and str_starts_with need PHP 7.4 and 8.0, so Sanitize.php did not parse on 7.2 and 7.3.
• substr() returns string|false below PHP 8.0, which broke the declared return type of parse_srcset().
• assertDoesNotMatchRegularExpression needs PHPUnit 9.1, but composer.json allows 8, which is what PHP 7.2 installs.

Two things outside the CI fix:

• enforce_allowed_html_nodes() already called str_starts_with, so it would fatal on PHP 7.2 and 7.3. No test reached it before, because none set allowed_html_elements_with_attributes(). Fixed here as well.
• srcset URLs never went through https_url(). With set_https_domains() set, src came out HTTPS while srcset stayed HTTP, so the browser would load the image over HTTP. srcset now goes through the same steps as src.