fix(sabr): use the page-native BotGuard attestation context - #86

Summary

PipePipe was fetching its BotGuard challenge from /youtubei/v1/att/get. For
WEB/MWEB sessions affected by YouTube's current verification, that challenge
can still produce PO tokens, but SABR rejects the video-bound token with status
2/3 because the snapshot does not contain the matching page context.

This change:

• fetches the YouTube homepage through PipePipe's downloader with the same user
  agent and credentials;
• extracts the initial window.ytAtN(...) challenge and EVENT_ID from the
  same response;
• sets window.yt.config_.EVENT_ID before BotGuard produces its snapshot;
• adds parser tests and fails closed when either part is missing.

The homepage itself is not loaded in the WebView. Only the extracted
attestation data is passed to the existing isolated runtime. The GenerateIT,
minter and Extractor flows are unchanged.

Validation

I first tested one variable at a time with the same page-native challenge:

• without EVENT_ID: status 2 around 60 seconds;
• with the matching EVENT_ID: status 1 beyond 65 seconds.

I then tested the automatic production path on Android 8, 10, 14 and 16. The
endurance run also completed 97 consecutive playlist items beyond 65 seconds,
all with status 1 and without an identity rotation, before I stopped it.

• ./gradlew :app:testDebugUnitTest :app:assembleDebug
• ./gradlew :app:lintDebug
• git diff --check

Related to InfinityLoop1308/PipePipe#2820.

Thanks @LuanRT for pointing us to LuanRT/BgUtils#44 :)