Addition: update figure role allowances - #415

A figure with a child figcaption is now limited to its implicit figure
role and the DPub doc-example role, per ARIA in HTML (w3c/html-aria#415).
A figure without a figcaption continues to allow any role.

Closes #3443

…5240)

Restricts the roles allowed on a `<figure>` element when it has a child
`<figcaption>`, per the ARIA in HTML update.

## What & why

Per [ARIA in HTML](https://www.w3.org/TR/html-aria/) (`#el-figure`,
[w3c/html-aria#415](w3c/html-aria#415)):

- A `figure` **with** a valid `figcaption` descendant allows **no role
other than `figure`**, plus the DPub role **`doc-example`**.
- A `figure` **without** a `figcaption` allows **any role** (though
`figure` itself is NOT RECOMMENDED) — unchanged.

axe previously modeled `figure` with a flat `allowedRoles: true` and an
inline comment admitting it couldn't match the figcaption case. This
replaces that with a `variant` using a `condition` matcher.

## Implementation notes

- The implicit `figure` role still passes via the existing
`allowImplicit` short-circuit, so the with-figcaption branch only needs
`allowedRoles: ['doc-example']`.
- The matcher checks **direct children** (`vNode.children?.some(...)`),
not a descendant walk: HTML's content model only permits `figcaption` as
the first/last child of `figure`, and a direct-child check avoids a
nested-`<figure>` false match (an inner figure's figcaption wrongly
restricting the outer figure).

## Behavior change

A `<figure>` with a `<figcaption>` and an explicit role other than
`figure`/`doc-example` (including `role="none"`/`role="presentation"`)
now flags on `aria-allowed-role` (minor impact). This is spec-correct
but will surface new findings for existing users.

## Tests
- `get-element-spec` unit — variant resolution with/without figcaption.
- `is-aria-role-allowed-on-element` and `aria-allowed-role` check units
— incl. an open **Shadow DOM** case.
- `aria-allowed-role` virtual-rule — figcaption-child cases (built with
`SerialVirtualNode`) plus the no-figcaption default.
- `aria-allowed-role` integration HTML/JSON — pass (`doc-example`,
implicit `figure`) and violation (`group`) cases; existing no-figcaption
pass retained as a regression anchor.

Closes #3443

---------

Co-authored-by: Steven Lambert <2433219+straker@users.noreply.github.com>