cookiebanner: address PR review feedback

- Detectors: keep batched entries in `pending` until the POST succeeds
  and guard against concurrent flushes, so transient network errors no
  longer silently drop detection reports.
- Worker: add stable tie-breakers to the merge-candidate sort so the
  greedy assignment produces deterministic groups across runs.
- Handler: skip resource entries with an empty URL (zero-value `uri.URI`
  when the `url` field is missing) before persisting them.
- Third-party detector: allow same-origin service worker scripts through
  `processResource` -- service workers are always same-origin by spec,
  so the previous filter made `wrapServiceWorker` unreachable.
- Resource row edit: bump the description cell `colSpan` to 3 so the
  edit row spans all five table columns.
- Resolver: handle `ErrSameResourceCategoryMove` explicitly so the no-op
  move returns a validation error instead of an internal one.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/cookiebanner/v1/handler.go

@@ -441,6 +441,14 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 	}
 
 	for _, res := range body.Resources {
+		// The URI type validates scheme+host on UnmarshalText, so a
+		// non-empty value here is guaranteed to be a valid URL. We
+		// still need to reject the zero value, which occurs when the
+		// `url` JSON field is missing.
+		if res.URL == "" {
+			continue
+		}
+
 		var resourceType coredata.TrackerResourceType
 		switch strings.TrimSpace(res.ResourceType) {
 		case "script":