fix: inject browser hash into node_modules module scripts

[ddddajie]

Description

Fixes #9828.

Module scripts that directly reference files in node_modules did not receive the dependency optimizer's browser hash, while imports of the same module through JavaScript did.

This caused the browser to see two different module URLs and instantiate the module twice.

This PR injects the current browserHash into eligible node_modules module script URLs during dev HTML processing, before pre-transform and module graph handling.

Public files, classic scripts, external/data URLs, and existing version queries are left unchanged.

Tests

Added a regression test that loads the same excluded dependency through both an HTML module script and a JavaScript import and verifies that it is instantiated only once.

Local checks passed:

• TypeScript
• ESLint
• oxfmt
• indexHtml unit tests
• git diff --check

The targeted optimize-deps browser test could not run locally because the Windows environment could not create the playground junction.

[ddddajie]

CI is currently failing on two unrelated tests:

macOS: playground/css-codesplit/tests/css-codesplit.spec.ts
Windows: playground/hmr-ssr/tests/hmr-ssr.spec.ts

The regression test added by this PR passes in the CI runs, and the Ubuntu Node 20/22/24/26 jobs are all green.

I don't have permission to re-run the failed jobs. Could a maintainer please re-run them when convenient?