Match JavaScript URIs case insensitively, such as JAVASCRIPT or
JavaScript.

Match <*:script> elements that are explicitly namespaced/prefixed with
the SVG namespace or XHTML namespace. We leave intact any other
namespace like a custom <filmmaker:script> script which isn't
executable.

## Summary

Backport the v4 `removeScripts` security hardening to v3's
`removeScriptElement` plugin:

- reject executable `data:` URLs and legacy `vbscript:` URLs while
preserving inert data URLs
- sanitize executable content inside SVG `foreignObject` elements
- recognize namespace-prefixed SVG anchors
- normalize ASCII tabs and newlines before checking URL schemes
- add v3 regression coverage and update the plugin documentation

This backports the fixes from #2263, #2264, and #2268 and addresses
GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

## Validation

- `yarn test` — 425 passed, 3 skipped
- `yarn lint`
- `yarn typecheck`
- `git diff --check`

## Summary

- switch the v3 publish workflow from Yarn's publisher to npm 11.5.1 so
npm trusted publishing can use GitHub OIDC
- build the package with Yarn before invoking npm with lifecycle scripts
disabled
- always publish this release line under the `v3` dist-tag
- use Node.js 24 for publishing

This fixes the authentication failure observed while publishing v3.3.5
(`YN0033: No authentication configured for request`).

## Summary

Configure `v3` through `publishConfig.tag` and let `npm publish` consume
it.

npm 11 rejects `--tag v3` at the CLI because `v3` is a valid semver
range, even though this package already uses `v3` as an established
registry dist-tag. `publishConfig` passes the tag to the registry
publisher without the CLI's semver-range validation, preserving the
existing dist-tag.