fix(css): rewrite urls in OnceExit-injected content

[soreavis]

Description

UrlRewritePostcssPlugin runs at Once, but postcss-modules prepends the CSS of composes dependencies at OnceExit — after the rewriter has already walked the tree. Content injected that late is never visited, so its url() references are left untransformed. The same applies to any user postcss plugin that injects content in its OnceExit; the comment above the plugin's registration already says it is added "because we don't know the content injected by those plugins", but injected-at-OnceExit content was still missed.

This moves the rewriter to OnceExit. It is registered last in the plugin array, so its hook runs after every other plugin's OnceExit and sees all injected content. The rewriter already resolves each declaration against declaration.source.input.file, so injected nodes that carry a source are rebased against the file they actually came from. Added a regression test with a plugin that injects a url() declaration at OnceExit.

Part of #15410 — the composed-CSS-module case additionally needs madyankin/postcss-modules#173 (prepended nodes currently carry no source), so this PR deliberately does not close that issue. One behavior note: url rewriting now happens at the end of the postcss pipeline instead of the start, so a plugin whose own OnceExit expected already-rewritten urls would now see raw ones — the new timing is the correct one for injection.