Add OASDIFF_INTERNAL to tag a review as a test review (#1114)

* Add OASDIFF_INTERNAL to tag a review upload as a test review

Setting OASDIFF_INTERNAL=1 appends ?internal=1 to the encrypted-review
upload and to the opened /review/e URL, so a review an author opens to
check their own changes can be told apart from a real user's review.
Unset by default, so a normal run is unchanged. Mirrors the existing
PLATFORM env var: an environment-only provenance marker, no CLI flag.

* Build the review URLs with net/url instead of Sprintf

Replace the string-concatenated URL construction (and the marker helper
that returned a raw "?internal=1") with a siteURL builder that returns a
*url.URL: JoinPath escapes each path segment, url.Values owns the query,
and the caller sets the #fragment. internalReview is now a bool predicate.