Add unit tests, modernize tooling and release 7.0.0 (ESM output)

[v-aidaba]

Add unit tests, modernize tooling and release 7.0.0

Aligns the package with the other powerbi-visuals-utils v7 repositories:
adds a unit test suite, migrates the lint/build tooling and makes CI
actually verify the code.

Tests:

• migrated to Vitest 4 with the jsdom environment, 80 tests, 96% coverage
• powerbi-visuals-api ships ambient const enums with no runtime
  representation, so a mock is aliased in place of the package while
  testing
• added test/tsconfig.json and a test:typecheck script

Tooling:

• TypeScript: ES2020 output with bundler resolution, strict, skipLibCheck
• ESLint: flat config, ESLint 9, typescript-eslint 8; tests are linted too
• added the missing typescript dev dependency
• scripts: prebuild, prepublishOnly, test, test:watch, test:coverage,
  test:typecheck, lint, lint:fix
• pinned jsdom to ^29.1.1, the last line supporting Node 20

Packaging:

• explicit files whitelist, sideEffects: false, keywords, author
• dropped the legacy jsnext:main

CI:

• build.yml now runs audit, lint, typecheck, tests and build on Node 20
  and 22; previously only lint ran
• modernized release.yml and codeql-analysis.yml, added Dependabot

Fixes:

• createVisualSubSelectionForSingleObject matched the sub-selection type
  with the in operator, which tests array indices instead of values, so
  the selection origin offset was never applied to NumericText and was
  wrongly applied to None
• getDataForElement is now typed as SubSelectionElementData | null
• ISubSelectionHelper.getAllSubSelectables now declares the filterType
  argument the implementation already accepted

BREAKING CHANGE: the package is published as ES2020 modules instead of
CommonJS, so a direct require() from Node is no longer supported; bundler
based consumption (webpack/pbiviz) is unaffected.

BREAKING CHANGE: powerbi-visuals-api moved to devDependencies and is no
longer installed transitively.

[Alexey (Demonkratiy)]

Ran the whole CI pipeline locally on this branch: lint, test:typecheck, test:coverage (80 tests, 96.3% statements / 92.1% branches), build, and npm audit --audit-level=high --omit=dev — all green. Lock file is clean too (no resolved outside registry.npmjs.org, no sha1- integrity).

Notes are inline.