fix: sanitize PaddleOCR table HTML

[koi-lee]

Description

• sanitize PaddleOCR table HTML before it is stored in Document.text and
  table_origin
• preserve table structure and safe layout attributes such as rowspan and
  colspan
• remove executable elements, event-handler attributes, unsafe URLs, and other
  non-table markup while preserving readable text
• add regression coverage for direct sanitization and the document storage path

Fixes #834

Type of change

• New features (non-breaking change).
• Bug fix (non-breaking change).
• Breaking change (fix or feature that would cause existing functionality not to work as expected).

Validation

• pytest libs/kotaemon/tests/test_paddleocr_loader.py -q
  • 6 passed, 12 skipped because the optional PaddleOCR dependency is not installed
• pre-commit run --files libs/kotaemon/kotaemon/loaders/paddleocr_loader/adapter.py libs/kotaemon/tests/test_paddleocr_loader.py
  • all hooks passed
• pytest libs/kotaemon/tests -q
  • 113 passed, 20 skipped
  • 5 unrelated Milvus Lite tests failed because its local mmap manager did not initialize

Checklist

• I have performed a self-review of my code.
• I have added thorough tests if it is a core feature.
• There is a reference to the original bug report and related work.
• I have commented on my code, particularly in hard-to-understand areas.
• The feature is well documented.