web: the pin glyph is decoration, tables have headers, filters say which is current !218

Three of the four items in #133.

• The pin control read "black star Pin" to a screen reader; the star is aria-hidden and the word carries the meaning.
• The refs and release-asset tables had no header row; both have scoped column headers (Branch/Tag and Commit; File, Bytes, SHA-256), styled like the tree's.
• The state filters on issues, merge requests and milestones marked the active one by colour only; it carries aria-current="page" now.

Left open on #133: a rendered README's h1 still follows the repo-title h1 as a second top-level heading. Demoting it means rewriting heading levels in the renderer, which is a separate change.

Stacked on !217; no code dependency.

Ref #133