Function unmask_html 

pub(crate) fn unmask_html(html: &str, originals: &[char]) -> String

Reverse the masking. For every MASK_CHAR in html, take the next entry from originals (in source-scan order, which matches the order they appear in HTML).

If originals runs short, remaining MASK_CHARs flow through unchanged — that is benign because they would be rendered as a PUA glyph in the browser and never collide with body text.