Ship highlight.js verbatim from @highlightjs/cdn-assets

[kellenmurphy]

AMO's review of 1.9.4 is stuck on reproducing the minification of lib/highlight.min.js, and I don't think that's winnable while we ship a custom build. There's no official artifact to checksum against, so the reviewer is forced to reproduce a build, and ours was never reproducible in the first place: package.json pinned highlight.js to a bare GitHub URL with no ref, the workflow re-resolved it with npm install --package-lock-only before clean-install, npm audit fix ran immediately before the build, and package-lock.json was export-ignored out of the release archive. Nothing in the submitted zip identified a fixed version. Their build also died at git rev-parse --short=10 HEAD because they unpacked the source zip rather than cloning — hljs embeds the commit hash in the banner, so corrected instructions wouldn't have helped either.

So this consumes the project's own published distribution instead, pinned exactly, copied without modification. @highlightjs/cdn-assets is highlight.js' own npm package rather than a third-party CDN rehost, which matters for the "official site" rule — package-lock.json records the tarball URL and its SHA-512 integrity hash, so a reviewer verifies the shipped files with npm ci and diff and never has to build anything. I've also stopped export-ignoring the lock-file for that reason, and dropped --package-lock-only and npm audit fix from the workflow, since both mutate the dependency tree at build time and reintroduce exactly the problem we're trying to fix.

The es/ modules give core plus only the xml, http and properties grammars, about 24 KB, slightly smaller than the custom build was. src/hljs-init.js is the only new first-party code: it imports those four files, registers the grammars and exposes hljs as a global so the page's classic scripts are untouched. It has to be a module script, but that's not a timing hazard — every hljs call site is event-driven, nothing runs at load. I verified in a loaded extension that window.hljs is defined, that exactly xml, http and properties are registered, that versionString is 11.11.1, and that highlightElement still emits hljs- classes with no console errors.

One wrinkle worth flagging: cdn-assets has no 11.11.1 successor published yet, so this pins one patch behind the 11.11.2 the lock-file previously resolved to. I think a documentable downgrade beats an unreproducible build, but it's your call.

Refs #109.