Rewrite origin URLs in meta refresh and meta CSP tags #1265

Description

#1238 rewrites origin URLs in the Refresh and Content-Security-Policy response headers to the serving host. Their page-body counterparts are not: the HTML rewriter only touches href, src, action, srcset and imagesrcset, so <meta http-equiv="refresh"> and <meta http-equiv="Content-Security-Policy"> keep origin URLs. These are the #1128 symptoms through a different carrier.

Steps to reproduce

1. Serve a publisher page through the Axum dev server whose origin is https://origin.example.com.
2. Include <meta http-equiv="Content-Security-Policy" content="img-src https://origin.example.com"> and an origin <img>.
3. Include <meta http-equiv="refresh" content="0; url=https://origin.example.com/refreshed.html"> on another page.

Expected behavior

• The meta CSP gains a serving-host source beside each origin source (additive, like the header rewrite), so the rewritten <img src> loads.
• The meta refresh target is rewritten to the serving host, with the same loop guards as the Refresh header (scheme-change and cookieless same-URL redirects left unchanged).

Actual behavior

• The img src is rewritten to the serving host, but the meta policy isn't, and the browser blocks the image with an img-src violation.
• The meta refresh navigates straight to the origin, off the serving host.

Raised in review of #1238: #1238 (comment). docs/guide/configuration.md currently notes that meta tags are not covered.

Done when

• <meta http-equiv="refresh"> and <meta http-equiv="Content-Security-Policy"> (and -Report-Only) are rewritten with the same rules as their response headers.
• Tests cover the CSP and refresh cases, including the loop guards.
• The configuration guide note about meta tags is removed or updated.

Affected area

HTML processing / JS injection