Add fallback fonts for more scripts and symbols to the browser image

Screenshots of pages that rely on system fonts can still show tofu boxes for some scripts and symbols, such as Arabic, Hebrew, Thai, Devanagari, extended Cyrillic and Mongolian, and symbols like ⌘ (U+2318). The browser image only ships Liberation, Noto Color Emoji, Noto CJK and GNU FreeFont. FreeFont covers several of these scripts only partly, and with a single serif design.

This adds Debian's fonts-noto-core to Dockerfile.sandbox. It provides sans and serif fallback fonts for:

• Arabic (Naskh/Kufi/Nastaliq), Hebrew, Thai, Devanagari and the other major Indic scripts
• full Cyrillic, traditional Mongolian, Armenian, Georgian and Ethiopic
• Noto Sans Symbols, Symbols2 and Math, for technical and math symbols
• about 150 further scripts

Fontconfig is already in the image as a Chromium dependency, and its apt trigger rebuilds the font cache in the same install step, so no explicit fc-cache is needed.

Image size: about +12 MB compressed and about +42 MiB uncompressed per architecture. The base image is Debian bookworm. I didn't add fonts-noto-extra (about 326 MiB of extra weights), fonts-noto-ui-core (UI variants of the same scripts) or Symbola, because none of them closes an identified gap.

Tests: tests/screenshot.integration.ts gets a test that draws one character per script, plus ⌘ and a CJK ideograph, on a canvas in Chromium. It compares each drawing with the missing-glyph box Chromium draws for an uncovered code point. Like the other integration tests, it runs with RUN_INTEGRATION=1.

Not yet verified:

• The image hasn't been built and the integration suite hasn't been run against it. tests/publish-image.test.mjs passes.
• To verify, publish a test tag with ./scripts/publish-image.sh <tag> and run RUN_INTEGRATION=1 node --run test:integration with REMOTE_AGENT_BROWSER_IMAGE pointing at that tag.
• Running the new test against the current latest should show which samples were missing before this change.

Merging this publishes remote-agent-browser:latest through the existing workflow. Consumers that pin a versioned tag need a new tag to pick it up.