p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/fetch/fetch.go

@@ -27,6 +27,7 @@ type Resource struct {
 	FinalURL    string
 	Status      int
 	ContentType string
+	Header      http.Header
 	Body        []byte
 	FetchedAt   time.Time
 	Hash        string
@@ -141,6 +142,7 @@ func (f *Fetcher) Fetch(ctx context.Context, rawURL string) (*Resource, error) {
 		FinalURL:    final,
 		Status:      resp.StatusCode,
 		ContentType: ct,
+		Header:      resp.Header.Clone(),
 		Body:        body,
 		FetchedAt:   time.Now().UTC(),
 	}