cookiebanner: address PR review feedback

- Detectors: keep batched entries in `pending` until the POST succeeds
  and guard against concurrent flushes, so transient network errors no
  longer silently drop detection reports.
- Worker: add stable tie-breakers to the merge-candidate sort so the
  greedy assignment produces deterministic groups across runs.
- Handler: skip resource entries with an empty URL (zero-value `uri.URI`
  when the `url` field is missing) before persisting them.
- Third-party detector: allow same-origin service worker scripts through
  `processResource` -- service workers are always same-origin by spec,
  so the previous filter made `wrapServiceWorker` unreachable.
- Resource row edit: bump the description cell `colSpan` to 3 so the
  edit row spans all five table columns.
- Resolver: handle `ErrSameResourceCategoryMove` explicitly so the no-op
  move returns a validation error instead of an internal one.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/cookiebanner/worker.go

@@ -272,8 +272,20 @@ func findMergeGroups(
 		}
 	}
 
+	// Sort by descending specificity (more fixed characters first), then
+	// descending coverage (more patterns matched first), then template
+	// name for a fully deterministic order. Without these tie-breakers
+	// the greedy assignment below depends on Go's randomised map
+	// iteration and the same input can produce different merge groups
+	// across runs.
 	sort.Slice(candidates, func(i, j int) bool {
-		return candidates[i].fixedChars > candidates[j].fixedChars
+		if candidates[i].fixedChars != candidates[j].fixedChars {
+			return candidates[i].fixedChars > candidates[j].fixedChars
+		}
+		if len(candidates[i].patterns) != len(candidates[j].patterns) {
+			return len(candidates[i].patterns) > len(candidates[j].patterns)
+		}
+		return candidates[i].key.template < candidates[j].key.template
 	})
 
 	assigned := make(map[*coredata.TrackerPattern]bool)