docs: Add a blog to perfetto.dev

For now the blog is hidden (i.e. it's not linked, works only if you
open perfetto.dev/blog/). I plan to unhide it later once we prove
everything works fine on the prod site.

A post is a directory named YYYY-MM-DD-slug holding post.md plus its
images. The date orders the feed but is dropped from the URL, so fixing
a wrong date doesn't break a permalink; images are hoisted to
/blog/media/<slug>/ so /blog/<slug> can stay an extensionless file like
the docs pages. Front matter is title/author/summary, authors being
@-prefixed GitHub handles as in rfcs/template.md.

The site gains a card index, an Atom feed, its own BM25 search index and
per-post covers. A cover is the post's first image, or generated from
the title when it has none; the index links 640px thumbnails instead of
full screenshots, which takes it from ~1MB of cover art to ~180KB.
Avatars are committed under authors/ (tools/fetch_avatars) rather than
hotlinked, so a reader loading a post sends nothing to github.com.

Two things needed generalizing rather than duplicating:

- render.mjs took /docs/ as the only content root. It now takes a `post`
  and switches link and image handling on it, and renderPage passes the
  front matter through to the template.
- Every article rule was written `.docs .doc`, which would have meant a
  post claiming to be a docs page to get typography. `.doc` and `.toc`
  are hoisted to the top level and renamed `.md-content`, which is what
  they always were; `.docs` and `.blog` are now separate shells that
  share them. That also fixes the footer licence notice, which was
  keyed off `.docs` and so went missing on the blog index.

The blog is deliberately unlisted for now: no top-bar link, and the feed
is advertised only on blog pages. Re-add the link in template_header.html
to launch it.

Drive-by: marked's mangle option obfuscated mailto: addresses with
Math.random(), which made every build byte-different. Disabled, so the
output is reproducible again.