html: properly render fostered elements in foreign content

When we foster elements under another parent, there are complicated
rules about which namespace may apply. This in particular affects
childTextNodesAreLiteral, which checks if we should be emitting raw
text, or escaped text.

In childTextNodesAreLiteral, check if there is an ancestor which has a
different namespace. If one is found, check if it's an HTML integration
point. If not, treat the node as if it were in its parents namespace, if
so, treat it as HTML.

Thanks to Tristan Madani for reporting this issue.

Fixes CVE-2026-42502

Change-Id: I0ae1780dae335e5f719d7f176cefa83670cfea3d
Reviewed-on: https://go-review.googlesource.com/c/net/+/781701
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Nicholas Husin <nsh@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Reviewed-by: Nicholas Husin <husin@google.com>
Auto-Submit: Gopher Robot <gobot@golang.org>