Harden inert snapshots and honor redirect URLs

[SihanTeng]

Summary

• Close active-content escape paths so the inert-snapshot promise holds: drop <base href>, neutralize iframe srcdoc / active data: URLs, strip live remote frames, and remove HTML/SVG object/embed (and remote plugins).
• Resolve relative links against the browser final URL and any document <base href>, while still writing the page under the discovered URL so existing offline links keep working.
• Rewrite non-UTF-8 charset declarations to utf-8 (serialized output is always UTF-8).

Test plan

• Unit tests for sanitize active-content / charset rewrite
• Unit tests for resolve-base selection (clone/resolve_test.go)
• go test -short -count=1 ./sanitize/ ./clone/

Related: #16

[tamnd]

Thanks for your contribution and interest in Kage! Feel free to ping me when you are ready for a review. : )