html: check all ancestor namespace transitions when rendering raw text

In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as <mglyph> or
<malignmark> fostered under <mtext>), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.

Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.

Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276)
for reporting this issue.

Fixes CVE-2026-97045
For golang/go#82622

Change-Id: I67d0006dce9023451905d8e96c4d1f3d05e769cc
Reviewed-on: https://go-internal-review.googlesource.com/c/net/+/6360
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-on: https://go-review.googlesource.com/c/net/+/855121
Reviewed-by: Neal Patel <neal@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>