A JUnit XML test report in a repository opens as its results: pass, fail and skip counts, then each failing case with its message #11072

Why: the forge is where tests live, and a JUnit report (.junit.xml, TEST-.xml, or any .xml whose root is <testsuites> or <testsuite>) today opens as raw XML.

Done:

• [x] A renderer in the shape of src/web/render/sarif.ts: totals (tests, failures, errors, skipped, time) at the top; then each suite with its failing and erroring cases first (name, classname, time, the failure message, the first 40 lines of its body in a <pre>), passing cases folded.
• [x] A small XML reader with no dependency and no entity expansion beyond the five predefined ones; DOCTYPE is refused (fallback to source with the reason).
• [x] Caps: at most 2,000 cases drawn, the page says how many were left out; every string escaped.
• [x] Registered in src/web/render/kinds.ts by name and root sniffing; an ordinary .xml still opens as source.
• [x] Tests: a mixed report, a malformed file, a DOCTYPE bomb, the cap, and escaping of a <script> in a message.

Files: src/web/render/junit.ts, kinds.ts, renderers.ts, test/render-junit.test.ts. Risks: XML parsing is where entity expansion and quadratic scans live; keep it linear and bounded.

Reviewed pull #11076 at its head: ticked A renderer in the shape of src/web/render/sarif.ts: totals (tests, failures, errors, skipped, time) at the top; then each suite with its failing and erroring cases first (name, classname, time, the failure message, the first 40 lines of its body in a <pre>), passing cases folded.; A small XML reader with no dependency and no entity expansion beyond the five predefined ones; DOCTYPE is refused (fallback to source with the reason).; Caps: at most 2,000 cases drawn, the page says how many were left out; every string escaped.; Registered in src/web/render/kinds.ts by name and root sniffing; an ordinary .xml still opens as source.; Tests: a mixed report, a malformed file, a DOCTYPE bomb, the cap, and escaping of a <script> in a message..