Sanitize X-ALT-DESC HTML in ICS output

[RasputinKaiser]

Summary

• sanitize every VEVENT X-ALT-DESC value before serving /calendar.ics, while preserving parameters such as FMTTYPE=text/html
• compact sanitized ICS HTML so download fixtures stay stable and avoid pretty-print whitespace churn
• run the sanitizer after the existing DESCRIPTION normalization so both source-provided and promoted X-ALT-DESC HTML are cleaned
• add regression coverage for unsafe script, javascript: URL, and inline handler content

Fixes #1187.

Duplicate check

• gh pr list --repo niccokunzmann/open-web-calendar --base main --state all --search "1187 X-ALT-DESC sanitize" returned no PRs
• gh pr list --repo niccokunzmann/open-web-calendar --base main --state all --search "X-ALT-DESC" only found merged Strip HTML from VEVENT DESCRIPTION in ICS output #1185, which intentionally preserved X-ALT-DESC verbatim and is the adjacent prerequisite this builds on

Tests

• .venv/bin/python -m pytest open_web_calendar/test/test_issue_167_html_in_description.py open_web_calendar/test/test_issue_466_merge_calendars_into_ics.py -q
• .venv/bin/python -m ruff check open_web_calendar/convert/ics.py open_web_calendar/test/test_issue_167_html_in_description.py open_web_calendar/test/test_issue_466_merge_calendars_into_ics.py
• git diff --check
• python3 fork-mode Behave run for features/issue-206-subscribe-to-ics.feature:3
• generated-vs-fixture splitline check for open_web_calendar/features/downloads/2024-03-22 Head Start Menu (ages 3-5).ics