Normalise RGB under transparent pixels so icon refreshes only diff on real changes

A PNG stores red, green and blue values for every pixel, including pixels whose alpha is zero. Those pixels never render. Their colour bytes sit in the file anyway, and they count toward the file hash.

Icons are mostly empty space, so this covers a large share of each file. Across resources/azure the median icon is 43% fully transparent.

Different SVG rasterisers leave different colours in that dead space, so the same artwork produces different files depending on who converted it. The committed icons show the split:

provider	white	black	mixed	no transparent pixels
azure (master, before #1204)	661	132	13	2
onprem	5	79	79	10
oci	0	18	123	0
ibm	0	41	0	140

No single tool reproduces any of those directories, because each accumulated over years from contributors running whatever they had installed.

The cost shows up on bulk refreshes. In #1204, 632 Azure icons changed and exactly one of them, compute/workspaces.png, looks any different. The rest is dead space flipping from white to black. Git cannot delta compress PNGs, so that is 6.43 MB added to the pack permanently, doubled once the website/static/img mirror follows.

I checked that the dead space is the whole story rather than a partial explanation. Zeroing the RGB wherever alpha is zero, on both sides, makes 145 of those files bit-identical, and all but one of the rest differ by under one part in 255 from anti-aliasing.

Proposal

Add a normalisation step to scripts/resource.py that zeroes the RGB of fully transparent pixels after conversion, and call it from autogen.sh for every provider rather than only the ones converting from SVG.

Run it once over the existing icons as its own commit. That costs one large diff, after which an icon refresh diffs only on artwork that changed, whatever tool the contributor used. Reviewing an icon PR then means looking at icons instead of taking the file count on trust.

Two things to check before writing it: that graphviz and the docs site render normalised files identically, which they should since nothing reads those bytes, and whether round and the ImageMagick path in svg2png2 need the step applied before or after they run.

Related: #1204, #1237.