/:owner/:name/waves/<version> renders one wave as a note: headline, highlights with their why, merged pulls as links #1856

Split from #1507. Waits for the list page so the two don't fight over the same route block.

Done looks like:

• [ ] /:owner/:name/waves/<version> validates the version against the pattern in src/story/wave.ts and renders the headline, the date, each highlight with its why, and the pulls as links. Only http(s) links become hrefs, and every value is escaped.
• [ ] An unknown or malformed version is a 404. An unparsable file shows its reason. Visibility is the repository's.
• [ ] Each line of the list page links here.
• [ ] Tests: rendering, a javascript: pull URL that does not become a link, a 404, and a private repository refused. They go in the list page's test file. Run test/asks.test.ts too before pushing.