This commit refactors the implementation of
`markdown_summary_with_limit()`, separating the logic of determining
when the limit has been reached from the actual rendering process.

The main advantage of the new approach is that it guarantees that all
HTML tags are closed, whereas the previous implementation could generate
tags that were never closed. It also ensures that no empty tags are
generated (e.g., `<em></em>`).

The new implementation consists of a general-purpose struct
`HtmlWithLimit` that manages the length-limiting logic and a function
`markdown_summary_with_limit()` that renders Markdown to HTML using the
struct.

The length limit turns out to be a surprisingly good heuristic for
initial allocation size. See here for more details [1].

[1]: rust-lang#88173 (comment)

This can happen when a tag is opened after the length limit is reached;
the tag will not end up being added to `unclosed_tags` because the queue
will never be flushed. So, now, if the `unclosed_tags` stack is empty,
`close_tag()` does nothing.

This change fixes a panic in the `limit_0` unit test.