feat: vendor and censor the phishing blocklist at build time (closes #219)

README.md

@@ -1812,7 +1812,7 @@ the name in prose: it is build-time tooling, never shipped, and it records the
 exact URL, the commit it is pinned to and the sha256 of the bytes that commit
 serves, because a source reference nobody can verify is not a source reference.
 `script/check-censored` reads the name back out of that one file and fails the
-build wherever else it appears, save for two shipped-code literals it cannot
+build wherever else it appears, save for three shipped-code literals it cannot
 avoid — each permitted only at the one path that carries it, and listed in that
 script's header.