Fix retained custom active timers overriding native CDM icons

[dfrisone]

What does this PR do?

Fixes retained Custom Active State timers overriding normally tracked CDM spells. For example, after adding Imp Lord as a Custom Spell ID, configuring a 120-second active state, removing it, and adding it through normal CDM tracking, the old timer could still cover the native cooldown display.

Apply the existing IsInjectedFrame check to user active-overlay rules, matching the restriction already used for custom cooldown-state effects. Native CDM icons now keep their normal display, including when moved to a custom bar. Genuine injected spell, racial, preset, item, and trinket icons retain their custom timers. Saved settings are preserved for reuse; built-in active rules keep their existing scope.

How was it tested?

• Reviewed against current upstream main (271ffc30, v9.1.8): one Lua file changed; no API, TOC, settings-schema, or public signature changes.
• Lua 5.1 regression harness loads the real module with rendering/event stubs and the two affected saved timer entries. All 44 checks pass; the unpatched source fails four checks covering native icons, moved native icons, and cleanup. Coverage also includes all five injected frame types, duration/color preservation, Hide Active State, profile rearm/reset, equipped-item/slot routing, and built-in/explicit-bar routing.
• EllesmereUI diff-scoped style gate, whitespace check, and locale extraction pass; locale keys are unchanged.
• Robin reported the corrected cooldown behavior in game. Local testing also confirmed two successful Imp Lord-to-Singe transitions on the original cooldown-fix build after clearing the profile's fixed custom icon. No icon override or diagnostic code is included here.
• Exact client build was not recorded. Restricted-combat/instance behavior, dedicated taint capture, profiler measurements, and native aura-container rendering were not independently verified by the offline harness.

Screenshots

Before/after screenshots were not supplied. The visual result was reported through in-game testing.

Checklist

• New settings default OFF (no behavior change without opt-in) - N/A: no new setting; this is a bug fix.
• Zero cost while disabled: no events registered, no polling, no hooks doing work, no frames built - verified for this diff: no new registration, hook, frame, or background work.
• Cheap while enabled: event-driven (no polling, no timer-based logic, no per-frame allocations) - one existing frame-kind predicate added to user-rule matching; rejected native icons skip overlay work.
• No writes onto Blizzard-owned frames (weak-table pattern used); HookScript/hooksecurefunc only, never SetScript on Blizzard frames - verified for the diff: only reads existing frame-kind flags; no new frame writes or hooks.
• Tested in-game on live; no version gates or pre-Midnight APIs added - user-reported Retail testing above; exact build and dedicated taint capture remain unverified.