An offline render has a gate for fonts and none for icons

[LeadcodeDev]

Split out of #425's fourth item rather than folded into it, because the shape of
the icon gate should follow the font one rather than precede it.

#320 landed --allow-remote-fonts: a Google font missing from the cache is
refused by name, with the URL that was not called and the directory to drop a TTF
into, and one global flag opts in. A face already in the cache needs nothing.

Icons have no equivalent. icon_source_cache fetches from
api.iconify.design on any source miss, from validate, still, sheet and
every encoder, with no opt-in and no way to say "this render must not touch the
network". #425 restored the ability to reuse a cache filled under the old naming,
which helps an offline render that already has its icons — it does not help one
that does not.

Two pieces, and the second is the one that makes the first usable:

• A gate. RemoteIconPolicy alongside RemoteFontPolicy, refused by default,
  naming the icon and the URL. Whether it shares --allow-remote-fonts or gets
  its own flag is the question to settle: one flag for "this scenario may reach
  the network" is simpler to explain than two, and harder to scope.
• A way to fill the cache on purpose. rustmotion icons prefetch -f scenario.json,
  or validate --offline reporting what is missing. A deny-by-default with no
  prefetch command turns an offline CI runner into a manual copy of TTFs and SVGs,
  which is what validate and still fetch Google Fonts over the network with no opt-in #320's cache_hint already asks of it for fonts.