feat(table): support rowspan attribute on td/th

[mitsuru]

Closes #394.

What

Add support for the rowspan attribute on <td> / <th>, which was
previously ignored (grid_row.end was hardcoded to span(1)).

How

Four changes in packages/blitz-dom/src/layout/table.rs:

1. Parse the rowspan attribute on table cells, clamped to
   [1, 65534] per the HTML Living Standard.
2. Apply it to grid_row.end (was span(1), now span(rowspan)).
3. Switch grid_column.start on each cell from an explicit
   line(col+1) to auto(), so Taffy handles column placement.
4. Set grid_auto_flow: RowDense on the table root style.

Step 4 is load-bearing. With the default sparse row-flow,
place_definite_secondary_axis_item keeps a per-item secondary-axis
cursor that carries across rows, so a cell in row N+1 starts its
column search from wherever the previous cell ended rather than from
the first track of its own row. That makes it impossible to backfill
columns freed up by rowspan cells from earlier rows.

The dense branch resets the column search to the first track on every
item. Each cell still honors its explicit grid_row, so inter-row
ordering is preserved; only the within-row column search is restarted
— exactly the behavior required for HTML table layout with rowspan.

Diff is 18 lines.

Testing

• cargo test -p blitz-dom — all existing tests pass.
• examples/rowspan.html (added in the first commit of this PR) —
  renders identically to Chrome after the patch. Before the patch the
  table is structurally broken (cell "6" collapses into column B,
  column C in row 3 is empty).
• Downstream smoke: applied the equivalent backport (branch
  rowspan-support-v0.2.x)
  to fulgur via [patch.crates-io]. Its 497 unit tests
  continue to pass and its rowspan fixture renders correctly as a PDF.

Follow-ups (not in this PR)

• rowspan="0" is clamped to 1 rather than interpreted as
  "span to end of row group" per HTML Living Standard §4.9.11.
  Browser behavior on the edge cases is inconsistent; happy to
  layer spec-exact semantics in a follow-up.
• A v0.2.x backport of the same change is available on
  rowspan-support-v0.2.x
  if a 0.2.x point release is on the cards.

[nicoburns]

@mitsuru Could you rebase on top of latest main? That ought to fix CI. I don't seem have permissions to edit the PR.

That also ought to get the WPT tests running (and it would be good to see how this affects those).

[nicoburns]

Hmm... running the WPT locally it's causing 2 tests to fail and none to pass which is not great...

Pass => Fail css/CSS2/tables/border-collapse-dynamic-cell-005.xht
Pass => Fail css/css-tables/visibility-collapse-rowspan-005.html

[nicoburns]

Hmm... it definitely seems to help some tables on https://en.wikipedia.org/wiki/Walt_Disney_World