fix(fast-element): harden DOM policy defaults

[janechu]

Pull Request

📖 Description

Hardens FAST Element DOM policy defaults by preserving default DOM element guards when partial element guard configs are provided and strengthening safeURL handling for mixed-case, whitespace/control-obscured, and percent-encoded unsafe protocols. The PR adds focused DOM policy tests and documents guard merging/security behavior.

📑 Test Plan

• npx biome check packages\fast-element\src\dom-policy.ts packages\fast-element\src\dom-policy.pw.spec.ts
• npm run build:tsc -w @microsoft/fast-element
• npx playwright test dom-policy.pw.spec.ts --project=chromium

✅ Checklist

General

• I have included a change request file using $ npm run change
• I have added tests for my changes.
• I have tested my changes.
• I have updated the project documentation to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the standards for this project.