Fix review follow-ups for literal text and link balancing

[jmanico]

Closes #476.

Summary

This fixes the four confirmed follow-ups from review of #463, #465, #466, #467, and #472:

• The literal-content tag scan now validates a candidate prefix before looking for its closing greater-than sign. A chunk containing one million less-than signs followed by one greater-than sign is handled in one pass instead of repeatedly scanning and copying the same suffix.
• Dropping a literal-text tag consumes the entire adjacent run of preceding less-than signs. The input <style><<img src=x onerror=alert(1)></style> now emits <style>img src=x onerror=alert(1)></style>, rather than synthesizing a tag-shaped <img sequence.
• Nested-link balancing uses the element name that actually survived policy. If one of the seven adoption-agency markers is dropped or renamed away, it cannot protect an outer anchor that remains in output. A marker that survives, or an element renamed into a marker, still preserves the browser-valid nesting.
• HtmlChangeReporter now receives package-private, per-document provenance for attributes rejected by the built policy. For href=javascript: followed by a surviving HTTPS href, the safe output is unchanged and discardedAttribute receives the rejected javascript: value.

No public API changes are introduced; the library and tests still compile to Java 8 bytecode. Reporting remains batch-first, then one value callback per dropped attribute in input order.

Security and release assessment

The renderer backstop for noscript, noframes, and noembed remains in place. The new hostile tests cover the literal-text splice and CPU cases, all seven formatting markers, policy renaming in both directions, reporter indirection, idempotent sanitization, and validator.nu browser parsing.

The literal-text CPU/splice defects and the policy-layer link round-trip mutation should be fixed before releasing the reviewed literal-text changes. This PR resolves those confirmed blockers. The separately known linear-memory issue #473 remains out of scope and tracked independently.

Verification

All commands passed from the repository root:

• JAVA_HOME=OpenJDK-11.0.32.1 ./mvnw clean verify
• JAVA_HOME=OpenJDK-17.0.20.1 ./mvnw clean verify
• JAVA_HOME=OpenJDK-21.0.12.1 ./mvnw clean verify
• JAVA_HOME=OpenJDK-25.0.4.1 ./mvnw clean verify

Each run includes the normal fuzzers, AntiSamy suite, Java 8 compilation, and JPMS consumer integration check.