A Jupyter notebook (.ipynb) renders as its cells and outputs, nothing run #10283

Done when:

• [x] .ipynb is a new textual kind in src/web/render/kinds.ts, rendered by a new src/web/render/notebook.ts.
• [x] Markdown cells go through the existing src/web/render/markdown.ts. Code cells are <pre> with the cell's execution count. Outputs are rendered as follows: stream and text/plain as escaped text, and image/png or image/jpeg as <img src="data:…"> (the CSP already allows img-src data:). text/html and application/javascript are shown as escaped source and are never inserted or run.
• [x] A notebook over the text limit (1 MB), or one that is not valid JSON, falls back to the plain-text view with one line saying why.
• [x] A test with a fixture whose HTML output holds <script>alert(1)</script> shows that the script arrives escaped, along with one markdown cell, one code cell and one PNG output.

Risks: XSS through outputs; escape everything.

Reviewed pull #10638 at its head: ticked .ipynb is a new textual kind in src/web/render/kinds.ts, rendered by a new src/web/render/notebook.ts.; Markdown cells go through the existing src/web/render/markdown.ts. Code cells are <pre> with the cell's execution count. Outputs are rendered as follows: stream and text/plain as escaped text, and image/png or image/jpeg as <img src="data:…"> (the CSP already allows img-src data:). text/html and application/javascript are shown as escaped source and are never inserted or run.; A notebook over the text limit (1 MB), or one that is not valid JSON, falls back to the plain-text view with one line saying why.; A test with a fixture whose HTML output holds <script>alert(1)</script> shows that the script arrives escaped, along with one markdown cell, one code cell and one PNG output..