docs(theme): serve GLightbox and the CC badge from the site itself

[titusz]

Privacy Badger flagged three third-party hosts on iscc.codes. Two are fixed here; the third is fixed on the iscc.ai side.

Changes

• unpkg.com: Zensical's bundle fetches GLightbox from unpkg unless the global is already defined. The theme now ships GLightbox 3.3.1 (MIT) under zensical_iscc/assets/iscc/vendor/glightbox/ and loads it in the head on pages whose content carries lightbox anchors, before the bundle runs. The template only sees a stripped config without the plugin key, so detection is by page content.
• i.creativecommons.org: the CC BY badge on the License page and the legacy specification was hot-linked. It is now docs/images/cc-by-4.0.svg, marked off-glb so it stays out of the lightbox.
• fonts.googleapis.com comes from the iscc.ai chat widget's public/theme.json; iscc.ai now self-hosts those fonts (separate change, pending deploy there).
• Pre-commit hooks leave the vendored files verbatim, the theme README documents the no-third-party-requests rule (including the Mermaid and navigation.instant caveats), and the docs ISCC-SUM stamp is regenerated for the added badge.

Verification

• prek run --all-files, check_site_paths.py, zensical build --clean, gen_markdown_pages.py and the site-dir path check pass.
• The built HTML contains no unpkg, Creative Commons, Google Fonts or CDN URLs.
• Local build in Chrome: the capabilities page loads GLightbox from its own origin and opens a figure with no unpkg request; the License page loads the badge locally.

Merge note

Both this PR and #135 regenerate the ISCC-SUM stamp line in docs/license.md; whichever merges second needs one rerun of the prek stamp hook.