feat: add camoufox support default for potoken generation

[unixfox]

Checklist

• I have read the AI Policy and understand the disclosure requirements

AI Disclosure

• AI was not used to create this pull request
• AI was used to fully create this pull request
• AI was used to partially create this pull request

Model(s) used (and thinking/reasoning level if relevant):
GPT 5.6 Sol (Max) + Claude Opus 4.8

Tool(s) used:
Opencode and Claude code

How was AI used?

GPT 5.6 Sol was used to fully write the code. And Claude Opus 4.8 reviewed the code and improved it.

---

Pull request description

While working on iv-org/invidious#5814, I found that a potoken generated by jsdom doesn't work. It needs to be generated from a real browser environment.

I have evaluated a lot of headless browsers:

• patchright: Required headless=false with xfvb. Not a good candidate because xfvb can be unstable.
• https://github.com/yfedoseev/browser_oxide: Doesn't have native integration for NodeJS so skipped.
• https://github.com/h4ckf0r0day/obscura: Could be a valid candidate but has some issues with awaitpromise when using CDP, issue opened v0.1.11: Runtime.evaluate awaitPromise returns null for resolved Promises h4ckf0r0day/obscura#541
• https://github.com/lightpanda-io/browser: Doesn't provide a valid potoken

I implemented camoufox because it doesn't require a virtual display, lower on memory usage than chromium and has very good stealth capabilities.

The code is implemented in a way that allows to swap to any other browser that support CDP protocol. In case we want to switch to a more lightweight one.

I don't fully like it but camoufox introduced a lot of requirements and was hard to package for docker + deno compile. It's the best candidate as of right now but I hope I'll be able to replace it with either oxide or obscura in the future.

This new potoken generation may allow being less blocked by YouTube.

So this PR adds a new potoken generation for the current way of fetching videoplayback URLs for DASH but will be mandatory for SABR usage.

Features

• Camoufox already built into the Docker image
• Renovate will create pull requests for new camoufox versions.
• bgutils is not used anymore, its behavior is entirely reproduced in attestation.ts. It's similar to what PipePipe do: https://github.com/InfinityLoop1308/PipePipeClient/blob/488c74340ddd846f67e1ee1c1b6694f23e2b0c33/app/src/main/assets/sabr_po_token.js#L110
• If camoufox can't be downloaded or ran, invidious companion will fallback to jsdom.