fix(policy): require evaluate for javascript: URL navigation

Fixes #2172

A daemon navigate request with a javascript: URL runs script in the current page, but the action policy only checks navigate. With "deny": ["evaluate"], eval is denied while navigate to javascript:document.title='x' still changes the page.

Changes

• policy_actions_for_command adds evaluate to the checked policy actions when navigate, tab_new, a11y, or vitals receives a URL whose scheme is javascript. This follows the existing pattern that adds navigate for a11y <url>.
• The scheme check uses url::Url::parse, so mixed case and leading whitespace (" JavaScript:...") are covered the same way Chrome parses them.
• Other URLs are unchanged: https://example.com/javascript: still checks only navigate.

Tests

• New unit test test_javascript_url_policy_actions_include_evaluate covers all four actions with lowercase and mixed-case/whitespace javascript: URLs, plus an https URL that must not require evaluate.
• cd cli && cargo test --bin agent-browser javascript_url_policy: fails without the change, passes with it.
• cargo fmt -- --check and cargo clippy are clean.