Use utils' getTabUrl() in tracker-protection instead of recreating

TODO:

1. Use utils' getTabUrl() in tracker-protection instead of internal function

• Delete getTabURL() from tracker-protection.js
• Import getTabUrl from ../utils.js
• Replace the single call site (this._topLevelUrl = getTabURL() in init())
• Zero behavioral change for tracker-protection since both resolve to the same URL

The two functions are functionally near-identical. Both:

1. Try globalThis.top.location.href first (full URL with path)
2. On cross-origin catch, fall back to ancestorOrigins (origin-only) and document.referrer
3. Wrap the result in new URL() with a null-safe catch
4. Return URL | null

Minor differences:

The fallback priority difference is the only semantic one: utils.js prefers ancestorOrigins over referrer (via ??), while tracker-protection.js lets ancestorOrigins override referrer. In practice the result is the same — when ancestorOrigins is available it wins in both cases; the referrer assignment in the tracker-protection version is just overwritten.

• The tracker-protection version was intentionally written with the bugbot-flagged ancestorOrigins fix already applied (the comment at line 33–34 is explicit about it). The utils.js version arguably has a subtler bug — if ancestorOrigins returns null and referrer is empty string, ?? picks the empty string (truthy for ?? but invalid for new URL). Unifying would be a good opportunity to pick the better implementation and propagate it, but that's a separate discussion.
• The dead-code nature makes the change trivial and safe to defer.

A one-line import swap in a fast-follow is low risk and keeps this PR focused on the tracker-protection feature itself.

Originally posted by @cursor[bot] in https://github.com/duckduckgo/content-scope-scripts/pull/2322#discussion_r2925619537

2. Zap destroy() dead code (see comment)

3. Do we want this in CI?