Add regression tests for unescaped script replacement text #1457

Description

#1222 fixed a bug where the HTML processor wrote script rewriter output with ContentType::Text. That made lol_html HTML-escape the replacement, so a rewritten inline script containing & or < came out with entities inside <script>. For example, the GTM snippet '&l='+l became '&l='+l and changed the request URL. The fix (ContentType::Html at crates/trusted-server-core/src/html_processor.rs:756) also appears in #1351, where it was first raised.

No test fails if this regresses:

• The GTM end-to-end test in crates/trusted-server-core/src/integrations/google_tag_manager.rs (around line 3403) feeds in a snippet containing '&l=' but only asserts that the src was rewritten.
• html_processor.rs has no test that runs replacement text containing & or < through the script text handler.

Scope

1. In html_processor.rs tests, add a test IntegrationScriptRewriter that returns ScriptRewriteAction::Replace with text containing &, <, > and " (for example if (a < b && c > d) { x = "&l=" + y; }). Assert that the output contains the replacement byte for byte, with no &, < or >.
2. In the existing GTM inline-script test, assert that the output still contains '&l='+l and does not contain &l=.
3. Optional: cover the chunked path (is_last_in_text_node == false on an earlier chunk), since the replacement is composed across chunks.

Done when

• Both tests pass on main.
• Changing ContentType::Html back to ContentType::Text at the replacement site makes both tests fail. Check this locally, don't commit it.
• cargo test-fastly and cargo clippy-fastly pass.

Affected area

trusted-server-core: HTML processor script rewriting, Google Tag Manager integration.