chore: refactoring run pt2, methods, structure, more dedup

[cure53]

refactor: extract _resolveSetOption helper for _parseConfig set options

The eight set-valued options (ALLOWED_TAGS, ALLOWED_ATTR,
ALLOWED_NAMESPACES, ADD_URI_SAFE_ATTR, ADD_DATA_URI_TAGS,
FORBID_CONTENTS, FORBID_TAGS, FORBID_ATTR) all resolved through the
same inline pattern: own-property check, isArray check, addToSet into
a fresh (optionally default-seeded) set, or fall back to the default.
Extract a module-level _resolveSetOption(cfg, key, fallback,
{transform, base}) and convert all eight sites.

Behavior preserved exactly: a fresh set object per parse on the array
path, the shared default on the fallback path, same transforms
(stringToString for namespaces). Only nuance: the clone({}) fallback
for FORBID_TAGS/FORBID_ATTR is now evaluated eagerly as an argument -
one discarded empty allocation per parse when the option is supplied,
no observable difference.

refactor: split _sanitizeElements into focused helpers (complexity 42 -> ~16)

Extract two helpers, both pure moves with the original comments kept:

• _isUnsafeNode(currentNode, tagName): the four structural-threat
  checks (namespace-confusion mXSS, style-with-element-child,
  processing instructions, markup-bearing comments) as a
  side-effect-free predicate; the caller performs the single
  _forceRemove. Check order preserved exactly; at most one check could
  fire per node before, so consolidating four removal sites into one
  is observably identical.

• _sanitizeDisallowedNode(currentNode, tagName): the disallowed-tag
  path - allowed-custom-element early keep (return false propagates
  out of _sanitizeElements exactly as the inline early return did,
  intentionally still skipping namespace/fallback checks and the
  afterSanitizeElements hook for kept custom elements), KEEP_CONTENT
  hoist with the full in-place rationale comment, then removal.

Also scopes the 'content' temp into the SAFE_FOR_TEMPLATES text block.
Clears the complexity-42 lint warning.

refactor: extract TT wrapping and write-back from _sanitizeAttributes (29 -> ~17)

Two helpers, moved verbatim from the per-attribute loop body:

• _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value):
  the Trusted Types getAttributeType switch. The previous inline shape
  ('if (namespaceURI) { /* unsupported */ } else { switch }') folds
  into a !namespaceURI conjunct on the guard - same outcome, value
  passes through unchanged for namespaced attributes.

• _setAttributeValue(currentNode, name, namespaceURI, value): the
  modified-value write-back including the post-set clobber re-probe
  and the arrayPop(DOMPurify.removed) bookkeeping, which is kept
  byte-for-byte (its pairing with the SANITIZE_NAMED_PROPS
  _removeAttribute is long-standing behavior and deliberately not
  'improved' here).

Clears the complexity-29 lint warning.

refactor: split _checkValidNamespace into per-namespace helpers (22 -> under 20)

Pure move: _checkSvgNamespace, _checkMathMlNamespace and
_checkHtmlNamespace each carry the rules (and original comments) for
one element namespace; _checkValidNamespace keeps the shared preamble
(simulated parent for shadow-DOM-in-JSDOM, ALLOWED_NAMESPACES gate),
dispatches on element.namespaceURI, and retains the XHTML custom
namespace tail and the fail-closed default.

With this, src/ lints with zero warnings.