Setup basic perf CI

[atuchin-m]

The PR:

1. adds a CI job to estimate perf via github-action-benchmark that fails on +30% regression. The job also pushes the data to GH pages to make graphs.
   2 updates easylists*, remove file duplicates and add brave main list in the benchmarks. Also provides a script to do the next updates.
2. adds a benchmark to measure the time to check the first request (~20ms).

An example (from a forked repo):

[github-actions]

_{reported by reviewdog 🐶}
[semgrep] An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/brave-third-party-action-not-pinned-to-commit-sha.yaml


Cc @thypon @kdenhartog

[atuchin-m]

SHA1 can't be used here, the action isn't designed for that:

File not found: '/home/runner/work/_actions/benchmark-action/github-action-benchmark/6bae118c112083251560ad8b3a1ff2e43aa23351/dist/src/index.js'

https://github.com/brave/adblock-rust/actions/runs/12953281281

I've set v1.20.4

[github-actions]

_{reported by reviewdog 🐶}
[semgrep] An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/brave-third-party-action-not-pinned-to-commit-sha.yaml


Cc @thypon @kdenhartog