fix: escape fallback raw-content ancestor tags in templates and processing instructions

[alan-agius4]

Escape ancestor fallback raw-content element closing tags (e.g., </noscript>) when serializing ProcessingInstruction nodes and when traversing DocumentFragment boundaries in <template> element content.

1. <template> DocumentFragment Boundary (GHSA-v3p8-whq6-r5jg):

   • A <template> element stores its children in a separate DocumentFragment (template.content, nodeType === 11). Because fallbackRawContentTags(node) previously only traversed nodeType === 1 elements, ancestor walks terminated at the fragment boundary without discovering enclosing fallback raw-content ancestors (such as <noscript> or <iframe>).
   • We attach a _host reference from the <template> element's _contentFragment back to the host <template> element (and preserve this across deep cloning via cloneNode).
   • fallbackRawContentTags(node) is updated to traverse from a DocumentFragment node to its _host, enabling discovery of fallback raw-content ancestors across template boundaries.

2. ProcessingInstruction Nodes (Incomplete fix for #70050 / #70055: </noscript> breakout still reachable through processing instructions angular#70146):

   • serializeOne() (case 7: //PROCESSING_INSTRUCTION_NODE) previously only escaped > via escapeProcessingInstructionContent(), without checking for matching fallback raw-content closing tags.
   • We mirror the comment node (case 8) logic: when PI data contains </, we check fallbackRawContentTags(parent) and escape matching closing tags (e.g., </noscript -> </noscript).

Fixes angular/angular#70146