proxy and fixup subtitles

proxy and fixup subtitles

proxying is necessary, because youtube doesn't send CORS headers. we
don't either, since we expect the consumer of the timedtext-proxy to
only be us ourselves. if someone wants to use it externally (e.g. as an
api), they'd have to add cors headers.

thanks goes out to perflyst[m] on #invidious for checking that
youtube's timedtext endpoint is "safe" for us to use.